Critical WordPress Core RCE - Update Now
- WordPress,
- Remote Code Execution,
- wp2shell
On Friday 17, July 2026 the WordPress security team released emergency forced automatic WordPress core updates 7.0.2, 6.9.5, and 6.8.6 via the auto-update system to address 2 vulnerabilities, one critical and one high severity security issue:
- An unauthenticated SQL injection issue involving the
WP_Queryvia theauthor_exclude/author__not_inquery parameter (CVE-2026-60137). - A REST API route/handler confusion in the REST API batch endpoint
/batch/v1that can be chained with the SQL injection to reach remote code execution (CVE-2026-63030).
The SQL injection was introduced in WordPress 6.8, and the SQL injection and batch-route confusion were introduced in 6.9.
These vulnerabilities individually were not a one shot takeover. The SQL injection was read-only, it reads data rather than writing it, and the batch confusion didn't hand the attacker admin access, but when these vulnerabilities are chained together, now commonly referred to as the wp2shell chain, they can lead to unauthenticated remote code execution.
wp2shell Chain
The reason the wp2shell chain is so rare, is it directly affects the WordPress core itself. It does not need a vulnerable plugin, vulnerable theme or access to an administrator account, nor does it require a site administrator to click a malicious link. All that's needed is a vulnerable WordPress installation which is exposed to the public internet.
Who Is Affected?
WordPress 6.8.x is affected by the unauthenticated SQL injection issue and should be updated to 6.8.6. WordPress versions prior to 6.8 are not affected. WordPress 6.9.x is affected by both vulnerabilities and should be updated to 6.9.5. WordPress 7.0.x is affected by both vulnerabilities and is patched in 7.0.2.
Where a site can't be updated immediately, it's recommended to:
- Install a plugin that blocks anonymous access to the REST API entirely; or
- Block
/wp-json/batch/v1and?rest_route=/batch/v1at a WAF level.
as a temporary measure until the site can be updated to the latest WordPress branch version the site is running.
What Happens If You Don't Update?
The wp2shell chain allows an attacker to gain full admin rights through the SQL injection. Once the attacker has an admin account they can log in, upload a plugin that's a webshell (a malicious script or backdoor that attackers upload to maintain remote control and manage files through an ordinary HTTP browser connection), and execute code with system level privileges.
Exploitation Begins
Various websites have reported that exploitation activity began within hours of the WordPress core updates being released.
Wordfence reported that "attackers were not merely scanning for the existence of the /wp-json/batch/v1 endpoint. They observed endpoint probing and SQL injection attempts the same evening, and public proof-of-concept code was reported in the days that followed."
Patchstack also published that they were "watching attackers weaponize the WordPress core RCE" and "the first real exploitation attempts hit Patchstack sensors roughly 90 minutes after 7.0.2 was released, three hours after the fix was committed." Patchstack go onto say that they "blocked more than 65,000 exploitation attempts against these two vulnerabilities, from more than 1,500 unique IP addresses."
Update Now
If your site is running WordPress 6.8 - 6.8.5, 6.9 - 6.9.4, or 7.0 - 7.0.1, you should look to update to the appropriate patched versions 6.8.6, 6.9.5 and 7.0.2 and as soon as possible, if you site hasn't already updated.