“wp2shell” vulnerability: Over 500 million WordPress sites at risk of RCE

A bolt from the blue has shaken the world of web design and cybersecurity. A critical vulnerability has just been identified in the core of WordPress which jeopardizes the safety of more than 500 million websites throughout the world. Known by experts as “wp2shell”, this flaw allows unauthenticated attackers to take full control of the site (complete takeover) without needing any credentials.

Given the very high level of danger, the WordPress.org team has already started the release of emergency patches forcing automatic updates.

Here's everything you need to know and how to secure your business or e-commerce website.

What is the “wp2shell” vulnerability and why is it so dangerous?

The vulnerability was discovered by researcher Adam Kues of the Assetnote team (Searchlight Cyber). Unlike most security issues affecting WordPress—often related to outdated third-party plugins or themes— wp2shell resides directly in the CMS core.

The attack exploits a confusion flaw in the batch routes of REST API native WordPress. This bug generates an exploit chain that starts from a’SQL injection (SQLi) and culminates in a Remote Code Execution (RCE) pre-auth.

Simply put:

• No requirements: The attacker does not need an account, secondary exploits, or special configurations.

• Zero interaction: Simply having a WordPress site online and accessible is enough to be vulnerable.

• Standard target: Even a clean, freshly launched WordPress installation, without any plugins, is at risk.

The flaws are officially tracked under two identifiers: CVE-2026-60137 (SQL injection related) and CVE-2026-63030 (the actual RCE chain).

Impacted Versions and Security Releases

The specific technical details of the exploit have not yet been made public to avoid a massive wave of automated attacks (attacks zero day on a large scale). However, we know for certain which branches of the software are involved:

Security Note: Given the extreme gravity of the situation, the official WordPress channels have started an extraordinary procedure forced automatic update for all affected instances.

How to Check if Your Site is Safe and What to Do

If you run a business website or e-commerce site for your business, checking the status of your CMS immediately is your top priority.

1. Check your WordPress version

Go to your site's dashboard and check that the version you are using is 7.0.2, 6.9.5 or 6.8.6 (or later). If you notice that your site is stuck on a previous release, immediately perform a manual update from the section Noticeboard > Updates.

2. Use the Free Scanner

The Searchlight Cyber team has made available a free scanning tool on wp2shell.com to check in real time if your platform is still exposed to the vulnerability.

3. Temporary Solutions (Workarounds)

If for technical or compatibility reasons you can't immediately update the WordPress core, experts recommend applying these emergency filters right away (knowing that they may limit some of your site's features):

• Set up your own WAF (Web Application Firewall) to block direct requests to endpoints /wp-json/batch/v1 is ?rest_route=/batch/v1.

• Temporarily install a security plugin to prevent anonymous (unauthenticated) access to the REST APIs.

The Digife Council

Faced with threats of this type zero-click is pre-auth Like wp2shell, temporary workarounds aren't enough: the’only real defense it's the immediate update.

We of Digife We always remind our customers how vital it is to have a consistent technical maintenance plan. If you have concerns about your website's security, fear that forced updates may conflict with your existing plugins, or want a professional server audit, Contact our technical support team. We'll secure your online business before it's too late.