WordPress issues emergency patch for critical wp2shell remote‑code execution flaw

Security researchers led by Adam Kues of Searchlight Cyber’s Assetnote team discovered a pre‑authentication remote‑code execution vulnerability in WordPress core, dubbed “wp2shell”. The flaw combines a REST‑API batch‑route confusion with a SQL‑injection, allowing an anonymous HTTP request to execute code on a default WordPress install with no plugins. It affects all sites running WordPress versions 6.9.0–6.9.4 and 7.0.0–7.0.1 (the 7.1 beta is also vulnerable) – an estimated 500 million+ websites worldwide.

WordPress released emergency updates on 17 July 2026: version 6.9.5 and 7.0.2, which patch both the critical RCE issue (CVE‑2026‑63030) and a high‑severity SQL‑injection (CVE‑2026‑60137). Because of the severity, the project forced automatic updates for affected installations. Administrators who cannot apply the update immediately are advised to block the REST‑API batch endpoint (/wp‑json/batch/v1) or disable the REST API via a web‑application firewall. A free online scanner (wp2shell.com) was also made available to test sites for vulnerability.