Are More Than 500 Million WordPress Websites at Risk? A New Critical “wp2shell” Vulnerability Allows Complete Remote Server Compromise!

A critical new vulnerability, dubbed “wp2shell,” has been discovered in WordPress, one of the world’s most widely used content management systems (CMS). If successfully exploited, this flaw allows attackers to execute arbitrary code remotely (Remote Code Execution – RCE) on the server and gain complete control over a website without authentication and without relying on any additional plugins.

According to security experts, this vulnerability could pose a serious threat to more than 500 million WordPress websites. As a result, the WordPress development team has released emergency security updates and is urging all users to update their systems immediately.

How does the “wp2shell” vulnerability work?

The vulnerability stems from a logical flaw in the REST API Batch Route mechanism within WordPress Core. This flaw creates a Batch Route Confusion issue during REST API request processing, enabling an attacker to perform an SQL Injection attack. The attack chain can then be escalated to achieve Remote Code Execution (RCE).

The most alarming aspect is that the attack does not require:

  • an administrator account;
  • an authenticated user session;
  • a vulnerable plugin or theme;
  • any non-default WordPress configuration.

This means that virtually any vulnerable internet-facing WordPress installation could become a target for automated cyberattacks.

Which versions are affected?

The vulnerability affects the following WordPress Core versions:

WordPress VersionStatus
6.8.5 and earlierNot affected by the RCE vulnerability
6.9.0 – 6.9.4Affected
7.0.0 – 7.0.1Affected
7.1 BetaAffected

Additionally, the vulnerabilities have been assigned the following identifiers:

  • CVE-2026-60137 — SQL Injection vulnerability;
  • CVE-2026-63030 — “wp2shell” Remote Code Execution vulnerability.

It is important to note that the WordPress 6.8 branch is only affected by the SQL Injection vulnerability and is not vulnerable to the RCE attack chain. This issue has been fixed in WordPress 6.8.6.

Why is this vulnerability so dangerous?

Remote Code Execution (RCE) vulnerabilities are considered among the most critical security flaws in cybersecurity.

An attacker who successfully exploits this vulnerability could:

  • gain complete control over the server;
  • deploy web shells;
  • install malware;
  • steal or modify databases;
  • create administrator accounts;
  • deface websites;
  • distribute malicious code to visitors;
  • recruit the server into a botnet;
  • use the compromised server as a staging point for ransomware attacks.

Given that WordPress powers millions of government websites, educational institutions, media outlets, e-commerce platforms, and corporate websites worldwide, large-scale exploitation of this vulnerability could result in widespread cybersecurity incidents.

Emergency security updates released

The WordPress development team has released the following updated versions:

  • WordPress 7.0.2
  • WordPress 6.9.5
  • WordPress 6.8.6

These updates address both the Remote Code Execution and SQL Injection vulnerabilities.

Due to the severity of the issue, the WordPress team has taken the unusual step of deploying forced automatic security updates to many affected websites. This emergency measure is intended to protect as many sites as possible without waiting for administrators to manually install the updates.

What if you cannot update immediately?

Some organizations may not be able to deploy updates right away. In such cases, the following temporary mitigation measures are recommended:

  • temporarily restrict anonymous access to the REST API;
  • block the /wp-json/batch/v1 and ?rest_route=/batch/v1 endpoints using a Web Application Firewall (WAF);
  • continuously monitor server logs;
  • analyze suspicious REST API requests.

However, security experts emphasize that these measures are only temporary mitigations and cannot replace installing the official security updates.

Recommendations for organizations

Cybersecurity experts recommend that organizations using WordPress infrastructure:

  • update WordPress Core to the latest secure version immediately;
  • enable automatic updates;
  • activate REST API attack detection rules in WAF and IDS/IPS solutions;
  • protect administrator accounts with Multi-Factor Authentication (MFA);
  • remove unused plugins and themes;
  • regularly analyze server logs;
  • conduct routine vulnerability assessments of web applications.

The newly discovered “wp2shell” vulnerability is considered one of the most critical flaws ever identified in WordPress Core in recent years. Its most concerning characteristic is that it can be exploited without authentication, without vulnerable plugins, and even against a default WordPress installation.

Considering that WordPress serves as the foundation for millions of websites worldwide, this vulnerability has the potential to facilitate large-scale cyberattacks. Therefore, all organizations and website administrators are strongly advised to install the official security updates as soon as possible, implement temporary mitigation measures where necessary, and continuously monitor their WordPress infrastructure for signs of malicious activity.