wp2shell: Patch the WordPress RCE Flaw Now

A critical flaw in WordPress core was made public on 17 July 2026. If your site has not received the patch, an attacker can take full control of it without logging in, without exploiting a plugin, and without any prior knowledge of your setup. That is the reality of wp2shell, and the window between disclosure and mass exploitation is already closing.

wp2shell combines two separate vulnerabilities in WordPress core: CVE-2026-63030, a route confusion flaw in the REST API batch endpoint at /wp-json/batch/v1, and CVE-2026-60137, an SQL injection in the author__not_in parameter of WP_Query. Together they form an unauthenticated remote code execution chain, meaning an attacker sends a crafted HTTP request to your site’s public endpoint and, if unpatched, achieves shell-level access. Eye Security’s defenders guide sets out the full technical breakdown. CVE-2026-63030 alone carries a CVSS score of 9.8 out of 10, the highest severity classification in practical use. Public exploits have already been released, and active exploitation attempts were captured in the wild as early as the Sunday after disclosure, according to Help Net Security’s incident reporting.

Researchers disclosed the flaw on a Friday. By the following Sunday, confirmed and suspected compromises were already being handled, with the gap between public knowledge and active attack measured in hours.

Shell Access Means Total Loss of Control

When an attacker achieves remote code execution on a WordPress server, they do not stop at the WordPress database. Shell access means they can read every file on the server, write new files, install backdoors, exfiltrate customer data, redirect visitors to malicious sites, and use your infrastructure to attack other targets. For a business running WooCommerce, this includes stored order data, customer names and addresses, and depending on your payment configuration, transaction metadata. Every person who has ever bought from you becomes a potential victim.

The regulatory dimension is direct. If your site processes personal data from UK or EU residents, a breach triggered by a known, unpatched vulnerability is a reportable incident under UK GDPR, and the Information Commissioner’s Office expects organisations to apply security patches in a timely manner. Running an unpatched site after public disclosure of a critical flaw with a CVSS score of 9.8 and active exploitation confirmed is difficult to defend to a regulator. The reputational cost of notifying customers that their data was exposed because a patch was not applied is harder still to recover from.

WordPress shipped patched versions 6.9.5 and 7.0.2 and pushed forced updates through its auto-update system. Every site running versions 6.9 and 7.0 was in scope until those patches arrived, as The Hacker News confirmed. The forced update mechanism is real, but it is not universal: managed hosting environments, staging configurations, sites with auto-updates disabled for compatibility reasons, and installations with customised file permissions can all prevent automatic patching from completing. Business owners who assume the patch has been applied because WordPress has an auto-update system are making an assumption, not a verification.

The scale of the exposure is significant. WordPress powers hundreds of millions of sites globally, and not every installation honours automatic updates, so a long tail of unpatched, internet-facing WordPress sites is expected to remain exploitable for months. Automated scanning tools probe every reachable endpoint at scale, and any site returning a vulnerable version fingerprint becomes a target of opportunity regardless of its size or profile.

How to Confirm Your Site Received the Patch

Checking your WordPress version takes under a minute. Log into your WordPress admin dashboard and look at the bottom of any screen, or go to Dashboard > Updates. You should be running 6.9.5 or 7.0.2 at minimum. If you see an earlier version in either the 6.9 or 7.0 branch, your site is currently vulnerable.

Knowing the version number is the start, not the end. A successful wp2shell attack may have already occurred before the patch was applied, and the indicators are not visible from the dashboard. Unexpected admin accounts, unfamiliar files in the wp-content directory, new scheduled tasks, or outbound requests your server should not be making all warrant investigation. A post-compromise audit requires server-level access and log analysis, which is outside what most business owners can do themselves.

One consequence that tends to get overlooked in the immediate response to a vulnerability like this is search engine blacklisting. Google’s Safe Browsing system flags domains that serve malware or redirect users to phishing pages, and if an attacker used your site to distribute malicious content before the patch was applied, your domain may already be flagged. Visitors will see a browser warning before they reach your site, and organic search traffic drops immediately. Recovering a blacklisted domain requires cleaning the site, removing the malicious content, and submitting a review request to Google — a process that takes time you will not get back.

If there is any doubt about whether your site received the patch, or whether it was compromised in the period between disclosure and patching, the right move is a professional security review.

---

I offer a focused wp2shell security audit for WordPress sites: version verification, patch confirmation, and a server-level check for indicators of compromise following the 17 July 2026 disclosure. Given that active exploitation was confirmed within 48 hours of the vulnerability going public, and that public exploits are now freely available, waiting increases the risk that a compromise has already occurred and gone undetected. Book a security audit to confirm your site is clean and patched.