wp2shell, the Critical WordPress Vulnerability: Affected Versions, Technical Impact, and What to Do Immediately

It is Friday, July 17, 2026. WordPress releases three security updates and, along with the new versions, enables forced automatic updates on the affected sites.

When a project like WordPress decides to push a patch like this, it's usually not just fixing the wrong color of a button.

The official announcement mentions a critical problem and a very serious one. WordPress recommends updating immediately and confirms that it has enabled forced updates precisely because of the severity of the issue.

There are two vulnerabilities: CVE-2026-60137, an SQL injection in the core, and CVE-2026-63030, an issue with handling batch requests in the REST API. When combined in the most recent versions, they form the chain called wp2shell and can lead to remote code execution without authentication.

Translation: On a vulnerable installation, the attacker does not first have to guess a password, convince an administrator to click a link, or wait for a specific plugin to be installed. The problem lies in the WordPress core.

This time, the update shouldn't be put on the to-do list for “when I have a moment.”.

Which versions of WordPress are vulnerable to wp2shell?

The two vulnerabilities do not affect exactly the same versions. This distinction is important because WordPress 6.8 is vulnerable to SQL injection, but not to the full chain of attacks leading to RCE.

Installed Version	SQL injection	RCE wp2shell Chain	Corrected version
6.8.0 – 6.8.5	Yes	No	6.8.6
6.9.0 – 6.9.4	Yes	Yes	6.9.5
7.0.0 – 7.0.1	Yes	Yes	7.0.2
7.1 beta prior to beta2	Yes	Yes	7.1 beta2 or later
Prior to 6.8	No, for these CVEs	No	However, that's no reason to stick with an outdated release

The official WordPress source classifies the REST API vulnerability as critical and confirms that, when combined with an SQL injection, it can lead to remote code execution. Cloudflare adds a useful clarification: the RCE affects installations starting with version 6.9 and later when persistent object caching is not enabled, a common configuration in many standard installations.

Running WordPress 6.7 or an even older version does not mean your site is secure. It simply means you are not exposed to these two specific vulnerabilities. An outdated version may have other issues that have long been known and fixed.

How the chain works, without turning this post into a manual for forwards

The first vulnerability affects WP_Query, the class that WordPress uses to build and manage many database queries. A parameter is not handled securely enough and could allow the intended query to be altered. This is the SQL injection vulnerability.

The second vulnerability involves the REST API's batch endpoint. In short, WordPress can misinterpret the path and the validations applied to a request, allowing an anonymous user to access a path that should have remained protected.

On its own, SQL injection has a more limited scope. When route confusion removes the barrier that kept it from affecting anonymous users, the two issues combine. This can lead to database read access, the compromise of an administrative account, and—in versions affected by the full chain—the execution of code within the web process context.

This does not automatically mean root access to the server. It does mean, however, that the website and everything the PHP process can read or modify must be considered at risk. On hosting environments with weak isolation, overly permissive permissions, or shared secrets, the damage can spread. It is not guaranteed, but it is technically plausible.

The technical damage doesn't end with the altered homepage

Defacement—that is, the visible replacement of a website’s content—is almost the milder version of the problem. It causes a stir and is quickly discovered. The most troublesome attacks try to stick around.

1. Database read or modified

The database may contain users, password hashes, content, configurations, data collected by forms, WooCommerce orders, and information stored by plugins and integrations. The exact content varies from site to site, but the idea is simple: the database doesn't just contain blog posts.

2. Compromised administrative accounts and sessions

An attacker may attempt to gain or create administrative access, change email addresses, modify roles, or keep a session active. Updating the core fixes the vulnerability, but does not remove a malicious administrator account created before the patch was applied.

3. Backdoors in files, plugins, or scheduled tasks

Malicious code can be hidden in a seemingly harmless plugin, a theme, a PHP file in an unusual folder, or a scheduled event. It can also modify existing files to make its persistence less obvious. The site returns to normal after the update, but the backdoor remains open.

4. Redirects, Phishing, Malware, and SEO Spam

A compromised website can display different pages to search engines, inject JavaScript, redirect only certain visitors, or host fraudulent content. This can disrupt indexing, trigger security warnings in browsers, damage the domain’s reputation, and make the cleanup process much more time-consuming than applying a patch.

5. Tokens and Integrations Listed

Many WordPress sites communicate with CRMs, email systems, payment gateways, automation services, and external APIs. This does not mean that wp2shell automatically compromises all of these systems. It means that credentials and tokens that can be read by the site may need to be revoked and regenerated if the installation is compromised.

The patch fixes the vulnerability. It doesn't turn back time.

This is the point that tends to get lost in the typical “update immediately” message.

The update is mandatory because it prevents new attacks based on this chain. If the site remained exposed, however, it’s also important to ask whether anyone gained access before the patch was applied. Exploitation activity was observed in the wild shortly after the disclosure, and as of July 19, VulnCheck had already verified more than two dozen public proof-of-concepts.

So: apply the patch first, then check right away.

What to Do Next, Step by Step

Check which version is actually installed, without assuming that the automatic update was successful.
Create a snapshot or a verifiable backup Before taking action. If there are already suspicious signs, be sure to preserve logs and evidence before cleaning up.
Update to the correct branch: 6.8.6, 6.9.5, 7.0.2, or a later version that includes the fixes.
Check to make sure the update has actually been applied and verify the integrity of the core files.
Perform a post-update check on login, forms, checkout, APIs, webhooks, automations, and custom functions.
Look for signs of compromise from the exposure window until the time of the patch.

From WP-CLI, basic commands can start with:

wp core version
wp core update --minor
wp core version
wp core verify-checksums

The update command modifies the site. On the production environment, it should be run with a backup available and with an immediate verification of critical functions. In a security emergency, however, I would not use an endless testing cycle as an excuse to leave a vulnerable version online.

What to Check After the Update

Abnormal requests to /wp-json/batch/v1 e ?rest_route=/batch/v1 in the web server, CDN, and WAF logs.
New administrator users, role changes, updated email addresses, and sessions you don't recognize.
Recently installed plugins or themes that were not expected.
Modified files, PHP in unusual directories, differences in core checksums, and obfuscated code.
Unexpected WP-Cron events, changes to wp_options, changed URLs, redirects, and altered configurations.

If you notice anything suspicious, don’t start deleting files at random. Isolate the site, preserve the evidence, reconstruct the sequence of events, and consider restoring it from a clean source. Then reset any passwords, sessions, keys, and tokens that the site might have accessed.

An application firewall can reduce exposure. Cloudflare has also deployed dedicated rules on its free plan for traffic actually proxied by its WAF. Searchlight Cyber also recommends temporarily blocking anonymous access to batch endpoints as an emergency mitigation measure. But this is, in fact, a temporary measure: it can disrupt legitimate functions and is not a substitute for a patch.

Frequently Asked Questions About wp2shell

Does wp2shell exploit third-party plugins or themes?

No. The chain affects the WordPress core and can impact a standard installation without plugins. However, any installed plugins may increase the number of potential paths an attacker can take once they gain access.

Am I vulnerable if I'm using WordPress 6.8.x?

Versions 6.8.0 through 6.8.5 are vulnerable to the CVE-2026-60137 SQL injection, but not to the full wp2shell RCE chain. The fix for this branch is WordPress 6.8.6.

Does the forced automatic update protect me?

It only provides protection if the update was successful. Filesystem permissions, configurations, management plugins, or deployment procedures may prevent or override the update. You should verify the actual version.

Is a WAF sufficient without updating it?

No. The WAF is an additional layer of defense and a temporary mitigation measure. The permanent fix is to update the core to a secure version.

If I've updated it, do I still need to check the website?

Yes, especially if the site remained online using a vulnerable version after the vulnerability was disclosed. The patch prevents new attacks exploiting the vulnerability, but it does not remove accounts, files, or backdoors created prior to the patch.

The business issue deserves a separate discussion

Here, I've focused on how it works technically, potential damage, and the checks that need to be performed. On At WebWakeUp, we’ve tackled the other side of the issue: business continuity, data, sales, reputation, and responsibilities among the company, the hosting provider, and the technical provider.