wp2shell: Critical WordPress Core Flaws Enable Unauthenticated RCE — Patch Now

Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites.

The flaws — CVE-2026-63030 and CVE-2026-60137 — are codenamed wp2shell. They live in WordPress Core (not a random plugin), work against a default install, and need no login. Public PoCs circulated after disclosure; security firms now report active exploitation.

Jake Knott, principal security researcher at watchTowr, told The Hacker News: “By the early hours of Saturday morning (UTC), successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public.” He added that from watchTowr’s global client base the impact spans organizations of every size and every vertical.

KEVIntel telemetry cited in that coverage links 13 unique IPs in Switzerland, Germany, the U.K., Indonesia, Lithuania, the Netherlands, and Singapore to exploitation of CVE-2026-63030.

Snapshot

This is not a duplicate of our Mac ClickLock or other July alerts — it is a WordPress Core emergency.

Do famous WordPress sites look vulnerable?

Marketing lists (for example Crocoblock’s popular WordPress websites roundup) often cite The White House, NASA, The New York Times, and similar brands as proof WordPress scales. We ran passive checks on July 23, 2026 (homepage generator / wp-json fingerprints + website-tech probes) — no active exploitation.

wp2shell RCE window: Core 6.9.0–6.9.4 and 7.0.0–7.0.1. Visible 6.9.5 / 7.0.2 = patched for the full chain.

Bottom line

• Among sites that expose a Core version, we did not find any in the wp2shell RCE ranges — NASA, TechCrunch, and Rolling Stone already show patched generators.
• Hidden version ≠ safe. White House, NYT, Harvard, Disney, and PlayStation Blog still need operators to confirm 7.0.2 / 6.9.5 / 6.8.6 internally.
• Several “famous WordPress” examples are not clearly WordPress on the public homepage today (TIME → Next.js; Microsoft News / Sony Music blocked our probes).
• Website-tech also flagged crocoblock.com at WordPress 6.7.2 (behind latest, but outside the 6.9+/7.0.x RCE window). A separate VIP fingerprint on Rolling Stone briefly reported an ancient 3.7.1 string — treat that as a probe artifact; the live generator reported 6.9.5.

Audit links (major properties): nasa.gov · nytimes.com · techcrunch.com · rollingstone.com · whitehouse.gov · harvard.edu · thewaltdisneycompany.com · blog.playstation.com

Affected versions

How the chain works

1. REST batch confusion (CVE-2026-63030) — Abuse of WordPress batch REST endpoints such as /wp-json/batch/v1 or /?rest_route=/batch/v1.
2. SQL injection (CVE-2026-60137) — Injection via WP_Query’s author__not_in parameter; used to read data (including password hashes) and drive further object abuse.
3. Privilege / RCE — Reported chains forge admin-capable outcomes and install webshells / malicious plugins for full site takeover.

Wiz notes HTTP 207/200 Multi-Status responses on batch endpoints and user-agents containing wp2shell / rezwp2shell as useful hunt signals.

What site owners should do now

1. Update immediately to WordPress 7.0.2, 6.9.5, or 6.8.6 (as appropriate for your branch). Do not assume auto-update worked — confirm in Dashboard → Updates.
2. Temporary mitigations (until patched): block /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF, or restrict anonymous REST API access. Cloudflare has deployed WAF rules for both CVEs (all plans, when traffic is proxied) — WAF ≠ patch.
3. Hunt for webshells, unexpected admin users, and odd plugins; review access logs for batch REST abuse.
4. Rotate credentials if compromise is suspected; treat hashed password exfiltration as a crackable risk.
5. Self-check tools such as Searchlight’s wp2shell.com checker can help triage — still patch either way.

Why Texas businesses should care

Law firms, clinics, restaurants, and chambers often run WordPress for public sites and client portals. An unauthenticated RCE means attackers can plant malware, steal form data, or use the site for phishing — the same exposure class we track in Texas OAG breach reports and our ClickLock Mac password advisory (different platform, same “patch / don’t trust the prompt” urgency).

Independent cybersecurity audits

We audited domains tied to this story on July 23, 2026. 100% is the ideal overall score — none reach it. These scores measure public email / transport / website posture, not whether a given WordPress install is patched.

How to read this

• cloudflare.com scores highest here and ships temporary WAF coverage — still patch Core.
• wordpress.org / wordpress.com show strong identity signals but weak transport (15%) and middling website headers — the emergency is Core RCE, not these marketing-domain scores.
• Researcher and news domains are included for context while this story is active.

Audit links: cloudflare.com · wiz.io · wordpress.org · wordpress.com · watchtowr.com · tenable.com · thehackernews.com

Website stack note

Passive website-tech probes on July 23, 2026:

Reference / researcher hosts: wordpress.org / wordpress.com → WordPress (version hidden; catalog latest 7.0.2); wiz.io → Next.js; tenable.com → Drupal (version hidden).

High-profile brand sample:

These probes do not replace confirming 7.0.2 / 6.9.5 / 6.8.6 on every property you operate. Point-in-time public signals only.

Priority actions for IT teams

1. Inventory all WordPress properties (prod, staging, forgotten microsites).
2. Force update to fixed Core; verify version string in admin and on disk.
3. Block batch REST paths at WAF until patched; keep blocks as defense-in-depth after.
4. Hunt webshells, new admins, and batch-endpoint Multi-Status spikes.
5. Rotate secrets and review backups if any site was exposed while unpatched after public PoCs.

Related trackers

• ClickLock Stealer Mac password coercion
• Breach monitoring resources
• Texas OAG breach reports YTD

Run a free Instant Cybersecurity Audit at audit.emailmenow.com or contact EmailMeNow IT Consulting for WordPress hardening, WAF rules, and DMARC / MTA-STS work aimed at the 100% ideal.

Sources: The Hacker News — wp2shell exploitation grows · BleepingComputer — public exploits, patch now · Tenable — wp2shell FAQ · Wiz — exploitation in the wild · NetSPI overview · Crocoblock — popular WordPress websites