{"id":14399,"date":"2026-07-18T10:03:44","date_gmt":"2026-07-18T10:03:44","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/07\/18\/new-wp2shell-rce-vulnerability-hits-millions-of-wordpress-sites-emergency-patch-released\/"},"modified":"2026-07-18T10:03:44","modified_gmt":"2026-07-18T10:03:44","slug":"new-wp2shell-rce-vulnerability-hits-millions-of-wordpress-sites-emergency-patch-released","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/07\/18\/new-wp2shell-rce-vulnerability-hits-millions-of-wordpress-sites-emergency-patch-released\/","title":{"rendered":"New wp2shell RCE Vulnerability Hits Millions of WordPress Sites, Emergency Patch Released"},"content":{"rendered":"

New wp2shell RCE Vulnerability Hits Millions of WordPress Sites, Emergency Patch Released
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A critical pre-authentication remote code execution (RCE) vulnerability dubbed \u201cwp2shell\u201d has been discovered in WordPress Core, putting an estimated 500 million+ websites at risk of full takeover by unauthenticated attackers.<\/p>\n

Security researcher Adam Kues of Searchlight Cyber\u2019s Assetnote research team uncovered the flaw, which stems from a REST API batch-route confusion issue that leads to SQL injection and, ultimately, remote code execution.<\/p>\n

What makes this bug especially dangerous is that it requires no preconditions and can be exploited by a completely anonymous, unauthenticated user against a stock WordPress installation with zero plugins installed.<\/p>\n

wp2shell RCE Vulnerability<\/strong><\/h2>\n

In practical terms, an attacker doesn\u2019t need a login, a vulnerable plugin, or any special site configuration to compromise a target \u2014 just a reachable WordPress instance running an affected version.<\/p>\n

Given the severity of the bug, Searchlight Cyber withheld technical exploit details<\/a> to give site owners time to patch, while releasing a free public scanner at wp2shell[.]com<\/a> so administrators can check whether their site is vulnerable.<\/p>\n

Which WordPress Versions Are Affected<\/strong><\/h2>\n

The vulnerability impacts a specific band of WordPress Core releases, tracked under two CVE identifiers: CVE-2026-60137 (also covering a separate SQL injection<\/a> issue) and CVE-2026-63030, the batch-route RCE flaw reported by Kues.<\/p>\n

\n\n\n\n\n\n\n\n\n
WordPress version range<\/th>\nStatus<\/th>\n<\/tr>\n<\/thead>\n
6.8.5 and earlier<\/td>\nNot affected<\/td>\n<\/tr>\n
6.9.0 \u2013 6.9.4<\/td>\nAffected<\/td>\n<\/tr>\n
7.0.0 \u2013 7.0.1<\/td>\nAffected<\/td>\n<\/tr>\n
7.1 beta (pre-release)<\/td>\nAffected<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Notably, the WordPress 6.8 branch is only affected by the SQL injection component (CVE-2026-60137), not the RCE chain, and a fix has been backported to version 6.8.6.<\/p>\n

WordPress.org has shipped version 7.0.2<\/a>, along with backported fixes in 6.9.5 and 6.8.6, addressing both the critical RCE issue and a high-severity SQL injection flaw. Because of the severity, the WordPress.org team has taken the unusual step of force-pushing this update via the auto-update system to all sites running affected versions, rather than waiting for administrators to act manually.<\/p>\n

Site owners can also update manually through the WordPress Dashboard by navigating to Updates and clicking \u201cUpdate Now,\u201d or by downloading the release directly from WordPress.org.<\/p>\n

The security team credited three researchers TF1T, dtro, and haongo for jointly reporting the SQL injection issue, alongside Adam Kues for identifying the REST API batch-route RCE chain.<\/p>\n

For administrators who cannot immediately update, Searchlight Cyber recommends emergency stopgap measures, though these may disrupt legitimate site functionality:<\/p>\n