Public exploits released for WordPress pre-authentication RCE chain affecting 500 million sites

Security researchers have released public proof-of-concept exploits for a critical two-flaw chain in WordPress Core — nicknamed wp2shell — that allows an unauthenticated attacker to achieve remote code execution on any default WordPress installation with no preconditions. WordPress estimates that more than 500 million websites run on its platform, making this one of the highest-impact web vulnerabilities disclosed this year.

The flaw chain was discovered by Adam Kues of Searchlight Cyber. The company's advisory puts it plainly: "The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins."

Two independent bugs, one devastating chain

The wp2shell attack combines two distinct vulnerabilities:

CVE-2026-63030 is a REST API batch-route confusion flaw introduced in WordPress 6.9. The bug allows an attacker to manipulate how WordPress processes batched API requests, creating a foothold for the second stage of the attack.

CVE-2026-60137 is a SQL injection vulnerability in the author__not_in parameter of WordPress's core WP_Query class. Alone, it affects WordPress 6.8 and later — but without the REST API flaw from 6.9, it cannot be elevated to code execution. Together, the two bugs form a chain that gives an attacker a shell on the server.

The full RCE chain affects WordPress 6.9.0 through 6.9.4 and WordPress 7.0.0 through 7.0.1. Sites still on 6.8.x are vulnerable to SQL injection but not to the full RCE chain.

In-the-wild exploitation already confirmed

After Searchlight Cyber delayed publishing technical details to give administrators time to patch, multiple proof-of-concept exploits appeared on GitHub. Some extract WordPress password hashes via SQL injection and crack an admin password to upload a malicious plugin. Others — more in line with what Searchlight Cyber described — claim to achieve full pre-authentication RCE without any credentials at all.

Security firm watchTowr confirmed it has already observed in-the-wild exploitation following the public exploit release.

Patches, forced updates, and WAF protections

The WordPress security team has already acted. WordPress 7.0.2 and 6.9.5 both contain the fixes, and the WordPress.org team has enabled forced automatic updates for all supported installations running affected versions — meaning most sites managed through wordpress.org will be updated without administrator action.

Cloudflare has also deployed Web Application Firewall rules blocking exploitation attempts for both CVEs across all plans, including free accounts proxied through its platform. The company was quick to note, however, that WAF protection "is not a substitute for patching."

What to do right now

The priority action is straightforward: update to WordPress 7.0.2 or 6.9.5 immediately. For sites that cannot update right away, Searchlight Cyber recommends either installing a plugin that blocks anonymous REST API access entirely, or blocking the routes /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF or web server level. The company has also launched wp2shell.com, a free tool that lets administrators check whether their installation is still vulnerable.

Given that public exploits are circulating and active exploitation has been confirmed, this is not a "patch within 30 days" situation. WordPress administrators who have not already updated should treat this as a same-day incident response task.