WordPress, the widely-used content management system, is currently facing active exploitation of two critical vulnerabilities, collectively known as ‘wp2shell.’ These flaws, identified as CVE-2026-63030 and CVE-2026-60137, allow unauthenticated attackers to execute remote code on default WordPress installations without the need for plugins or user authentication.
The vulnerabilities were discovered by Searchlight Cyber, which reported that the exploit chain enables remote code execution on any WordPress version released since December 2025. The attack leverages a REST API batch-route confusion (CVE-2026-63030) and an SQL injection flaw in the ‘author__not_in’ parameter of ‘WP_Query’ (CVE-2026-60137). When combined, these vulnerabilities permit an anonymous HTTP request to execute arbitrary code on a vulnerable WordPress site.
Following the public disclosure, attackers have rapidly begun exploiting these vulnerabilities. Security researchers have observed mass scanning and exploitation attempts originating from multiple countries, including Switzerland, Germany, the U.K., Indonesia, Lithuania, the Netherlands, and Singapore. Initial attacks focused on exfiltrating hashed credentials, with subsequent activities escalating to remote code execution.
In response, WordPress released security updates 6.9.5 and 7.0.2 on July 17, 2026, to address these critical issues. While automatic updates have been enabled, administrators are strongly advised to verify that their installations have been updated successfully, as auto-updates may fail on sites with disabled automatic updates.
Cloudflare has noted that CVE-2026-63030 enables unauthenticated remote code execution only when a persistent object cache is not in use. This highlights the importance of proper configuration and the need for administrators to review their caching settings as part of their security measures.
Given that WordPress powers a significant portion of the web, the impact of these vulnerabilities is substantial. Administrators should prioritize applying the latest patches and consider implementing additional security measures, such as web application firewalls (WAFs), to mitigate potential exploitation attempts.
The rapid exploitation of the ‘wp2shell’ vulnerabilities underscores the critical importance of timely patch management and proactive security practices. Organizations must remain vigilant, ensuring that their systems are up-to-date and properly configured to defend against emerging threats.
