The wp2shell attack chain involves two independent vulnerabilities in WordPress Core: CVE-2026-63030, a REST API batch-route confusion vulnerability introduced in WordPress 6.9, and CVE-2026-60137, a high-severity SQL injection vulnerability affecting WordPress 6.8 and later. When combined, these flaws allow unauthenticated attackers to execute remote code on WordPress installations running versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The SQL injection alone affects versions 6.8.0 through 6.8.5 but cannot be chained to RCE without the REST API flaw. WordPress has responded by enabling forced automatic security updates to versions 6.9.5 and 7.0.2, which fix the vulnerabilities. Public proof-of-concept exploits demonstrate the ability to extract password hashes and execute commands without authentication. Temporary mitigations include blocking REST API access or specific batch endpoints via plugins or WAF rules. Cloudflare has deployed WAF protections for these vulnerabilities across all plans. Due to the critical nature and public exploit availability, immediate patching is essential.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on vulnerable WordPress sites, potentially leading to full site compromise. The vulnerabilities affect default WordPress installations without requiring plugins or prior authentication. Public proof-of-concept exploits enable attackers to extract administrator password hashes, crack them, and upload malicious plugins to execute commands. Early reports indicate some in-the-wild exploitation following public exploit release. Given WordPress's widespread use (over 500 million sites), the impact is potentially massive.

A fix is available in WordPress versions 6.9.5 and 7.0.2. WordPress has enabled forced automatic security updates for supported installations running affected versions. Site administrators should update immediately to these patched versions. Temporary mitigations include installing plugins that block anonymous access to the REST API or blocking the /wp-json/batch/v1 and ?rest_route=/batch/v1 endpoints at the WAF level. Cloudflare users benefit from WAF protections deployed across all plans. These mitigations are temporary and do not replace patching. Administrators should verify their sites are updated and test for vulnerability using tools such as wp2shell.com.