Summary
A critical pre-authentication remote code execution chain in WordPress Core, dubbed “wp2shell”, is under active exploitation. Discovered by researchers at Searchlight Cyber, the chain combines two CVEs: CVE-2026-63030 (a REST API batch-route logic flaw, CVSS 9.8) and CVE-2026-60137 (a WP_Query SQL injection, CVSS 9.1). Chained, they allow an unauthenticated attacker to achieve full remote code execution on a default WordPress installation — no plugins, no special configuration, just a URL.
The vulnerability affects WordPress versions 6.9.0–6.9.4 and 7.0.0–7.0.1. WordPress.org released emergency patches on July 17, 2026 (versions 6.9.5 and 7.0.2) and enabled forced automatic updates. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on July 21. Public PoC exploits are actively circulating on GitHub, and in-the-wild attacks began within hours of disclosure. WordPress 6.8.x is also affected by the SQL injection in isolation, addressed in 6.8.6.
A notable footnote: GPT-5.6 Sol Ultra was reportedly used to develop the full exploit chain in approximately 10 hours — a sharp demonstration of AI-accelerated offensive research.
Source
Wordfence Blog
SecurityWeek
Rapid7 ETR
CISA KEV Catalog
Commentary
This is the first unauthenticated WordPress Core RCE in nearly a decade and it lands on the busiest CMS on the planet. The attack surface is staggering — 40%+ of the web running WordPress means mass exploitation is essentially inevitable. Forced auto-updates are the right call, but hardened enterprise installs, staging environments, and self-hosted deployments won’t always absorb them cleanly. Anyone managing their own WordPress servers should verify patch status immediately and audit /wp-json/batch/v1 access logs for exploitation indicators.
The AI-assisted exploit development angle changes the calculus for defenders. What once took skilled researchers weeks can now be compressed to hours. The window between disclosure and mass exploitation is closing fast — patch cycles that assume days of breathing room are obsolete.