Critical WordPress Core Vulnerability (wp2shell): Patch Immediately

Published: July 19, 2026 Severity: Critical

Executive Summary

A critical vulnerability chain, publicly known as wp2shell, affects the WordPress Core REST Batch API. The issue enables an unauthenticated attacker to abuse the Batch API, trigger a SQL injection condition, and potentially achieve Remote Code Execution (RCE).

Unlike many WordPress compromises, this vulnerability does not require a vulnerable plugin or theme. The flaw exists within WordPress Core, meaning any internet-facing installation running an affected version may be vulnerable.

The exposed endpoints include:

• /wp-json/batch/v1
• /?rest_route=/batch/v1

WordPress addressed these vulnerabilities in security releases published on July 17, 2026. Organizations should immediately upgrade to:

• WordPress 7.0.2 or later
• WordPress 6.9.5 or later
• WordPress 6.8.6 or later (related SQL injection fix)

Temporary mitigations, such as WAF rules or application-layer protections, may reduce immediate exposure but are not substitutes for installing the official security update.

Immediate Action: Inventory every WordPress deployment — including production, staging, development, customer portals, and legacy installations — and verify that each instance has been updated successfully.

WP2SHELL — What is CVE-2026–63030?

Overview

WordPress provides a REST Batch API that allows multiple REST requests to be processed within a single HTTP request.

Researchers discovered a critical weakness (CVE-2026–63030) in the Batch API’s internal request routing. Under specific conditions, malformed requests can desynchronize request validation from route execution, allowing later requests to be processed in an unintended security context.

When combined with CVE-2026–60137, a SQL injection vulnerability affecting WP_Query, attackers may chain both flaws to achieve complete compromise of vulnerable WordPress installations.

This advisory intentionally excludes exploit payloads and offensive proof-of-concept code. Administrators only need sufficient technical detail to identify affected systems, assess risk, and apply the official remediation.

Why This Matters

The reported vulnerability chain is particularly severe because it is:

• Unauthenticated — No valid WordPress account is required.
• Remote — Exploitable over standard HTTP(S).
• Core-Level — No vulnerable plugins or themes are necessary.
• High Impact — May result in SQL injection, privilege escalation, and Remote Code Execution.
• Widely Discoverable — The affected REST endpoint is publicly exposed on most default installations.

A successful compromise could allow an attacker to:

• Gain administrative access
• Modify website content
• Install malicious plugins or backdoors
• Steal sensitive database information
• Execute arbitrary PHP code
• Establish long-term persistence
• Use the compromised server to launch additional attacks

Because the vulnerability affects WordPress Core itself, organizations should treat this as an emergency patching event.

Affected Versions

The following WordPress releases are publicly reported as vulnerable.

BranchVulnerable VersionsFixed VersionWordPress 7.07.0.0–7.0.17.0.2WordPress 6.96.9.0–6.9.46.9.5

The related SQL injection vulnerability was also addressed in WordPress 6.8.6.

Organizations should always deploy the latest supported security release rather than relying solely on version ranges.

Technical Summary

The REST Batch API processes multiple API requests within a single transaction.

In vulnerable releases, malformed requests can interrupt internal request parsing without correctly synchronizing validation and route handling. Subsequent requests may therefore execute against unintended handlers, bypassing expected validation and permission checks.

Researchers demonstrated that this routing weakness can be chained with the WP_Query SQL injection vulnerability, allowing attackers to progress from an unauthenticated request to complete system compromise under vulnerable conditions.

The Batch API should therefore be considered the initial entry point for the broader wp2shell attack chain rather than an isolated REST API issue.

Recommended Response

Organizations should prioritize the following actions immediately:

1. Upgrade every WordPress installation to a patched release.
2. Verify the installed version after updating.
3. Review all internet-facing WordPress assets, including forgotten staging environments.
4. Inspect administrator accounts, plugins, uploads, scheduled tasks, and server logs for signs of compromise.
5. Restrict anonymous access to the Batch API until all systems have been patched.
6. Rotate credentials, API keys, authentication secrets, and WordPress salts if compromise is suspected.

Temporary mitigations may reduce exposure, but patching WordPress Core remains the only permanent remediation.

Conclusion

The wp2shell vulnerability chain represents one of the most significant WordPress Core security issues in recent years. Because exploitation begins with an unauthenticated request and can ultimately result in Remote Code Execution, organizations should treat remediation as an emergency.

Update every WordPress deployment immediately, verify the installed version, monitor for suspicious Batch API activity, and perform a post-patch compromise assessment where exposure is suspected.

Rapid patching is the only reliable long-term defense against this vulnerability.