Overview
- The vulnerability chain known as wp2shell combines a REST API batch-route confusion bug added in WordPress 6.9 (CVE-2026-63030) with an SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137) to enable pre-authentication remote code execution on default installs.
- WordPress published security fixes in versions 6.9.5 and 7.0.2 and enabled forced automatic security updates for supported installs to accelerate remediation.
- Public proof-of-concept exploits appeared within days of the fixes, and security firms have reported early in-the-wild exploitation that increases urgency for administrators to verify and update their sites.
- Administrators who cannot update immediately should block anonymous access to /wp-json/batch/v1 and ?rest_route=/batch/v1 at a WAF or disable unauthenticated REST access as a temporary mitigation, recognizing these steps may break legitimate site integrations.
- Because WordPress powers a large portion of the web and past core flaws have led to mass compromise campaigns, defenders should expect scanning and exploitation activity to rise and prioritize patching, testing backups, and monitoring for unauthorized changes.