wp2shell is a critical unauthenticated remote code execution (RCE) vulnerability chain in WordPress Core that allows anonymous attackers to take full control of a server without requiring plugins, special configurations, or user credentials. Discovered by Searchlight Cyber and disclosed on July 17, 2026, it affects over 500 million websites globally by chaining two core flaws:
- CVE-2026-63030: A route confusion bug in the REST API batch endpoint (/wp-json/batch/v1) that bypasses permission checks, allowing unvalidated requests to access protected handlers.
- CVE-2026-60137: A SQL injection in the WP_Query layer that exploits the misaligned requests to forge administrator accounts and achieve code execution.
Affected WordPress versions include 6.9.0–6.9.4 and 7.0.0–7.0.1; these were patched in 6.9.5 and 7.0.2 on July 17, 2026. Attackers have been observed deploying persistent webshells and malicious plugins to maintain access after exploitation.