WordPress Critical ‘wp2shell’ Vulnerabilities: Immediate Patching Required

A severe security threat has emerged for hundreds of millions of websites worldwide. Two critical vulnerabilities within the WordPress Core, now being tracked under the identifier wp2shell, have reached the stage of public exploitation. Because these flaws allow for unauthenticated remote code execution (RCE), they represent a significant risk to the integrity of any affected installation.

Understanding the wp2shell Attack Chain

The wp2shell threat is not a single bug, but a dangerous combination of two independent vulnerabilities. When chained together, they provide an attacker with the ability to execute arbitrary code on a target server without requiring a password or prior authorization. This bypasses traditional authentication controls entirely, making it one of the most critical threats to the platform in recent memory.

The two vulnerabilities involved in this chain include:

While the SQL injection issue (CVE-2026-60137) affects installations starting from version 6.8.0, the REST API confusion bug (CVE-2026-63030) was introduced in version 6.9. The full RCE chain is therefore primarily a threat to users running versions 6.9.x through 7.0.1.

The Urgency of Patching

The release of public proof-of-concept (PoC) code has shifted the threat landscape from theoretical to active. Security monitoring organizations have already reported instances of in-the-wild exploitation. Because the vulnerability allows an attacker to bypass administrative login screens, organizations that rely on WordPress for content delivery or business operations are at high risk of data breaches, site defacement, or the deployment of persistent backdoors.

In response to the gravity of the situation, the WordPress project has taken the rare step of forcing automatic security updates for sites running affected versions. While this automated measure is a critical safeguard, administrators should manually verify that their sites have been successfully updated to version 6.9.5 or 7.0.2.

Defensive Measures for Administrators

For organizations that cannot perform an immediate update, or those operating in complex enterprise environments where testing is required before deployment, there are temporary mitigations available to reduce the attack surface:

• REST API Restrictions: Administrators can install plugins or configure server-side rules to block anonymous access to the REST API endpoints associated with the batch-route process.
• Web Application Firewall (WAF) Rules: WAF configurations can be updated to explicitly drop requests containing the malicious patterns identified in the wp2shell chain. For example, blocking access to /wp-json/batch/v1 at the edge can serve as an effective stopgap.

It is important to emphasize that these mitigations are strictly temporary. WAF protections and API blocks provide a layer of tech-security defense, but they do not resolve the underlying vulnerability within the application code itself.

Governance and Data Protection Implications

From a data-protection standpoint, the wp2shell vulnerability is a reminder of the fragility of modern web infrastructure. When the core of a popular platform becomes susceptible to unauthenticated RCE, the confidentiality and integrity of all user data stored within that database are effectively forfeit. If an attacker gains full control, they can dump password hashes, intercept sensitive user submissions, or exfiltrate customer databases.

Security teams and data protection officers must treat this incident as a priority for their compliance audits. Ensuring that automated updates are functional and that incident response plans account for core platform vulnerabilities is essential for maintaining digital trust. As public exploits continue to circulate, the window for remediation is closing. Patching remains the only definitive way to close the door on attackers leveraging the wp2shell chain.