Web Dandy Web Design Articles
Web Dandy Web Design Articles

Critical WordPress Core Remote Code Execution (RCE) - Update Now

On Friday 17, July 2026 the WordPress security team released emergency forced automatic WordPress core updates 7.0.2, 6.9.5, and 6.8.6 via the auto-update system to address 2 vulnerabilities, one critical and one high severity security issue:

  • An unauthenticated SQL injection issue involving the WP_Query via the author_exclude / author__not_in query parameter (CVE-2026-60137).
  • A REST API route/handler confusion in the REST API batch endpoint /batch/v1 that can be chained with the SQL injection to reach remote code execution (CVE-2026-63030).

The SQL injection was introduced in WordPress 6.8, and the SQL injection and batch-route confusion were introduced in 6.9.

These vulnerabilities individually were not a one shot takeover. The SQL injection was read-only, it reads data rather than writing it, and the batch confusion didn't hand the attacker admin access, but when these vulnerabilities are chained together, now commonly referred to as the wp2shell chain, they can lead to unauthenticated remote code execution.

wp2shell Chain

The reason the wp2shell chain is so rare, is it directly affects the WordPress core itself. It does not need a vulnerable plugin, vulnerable theme or access to an administrator account, nor does it require a site administrator to click a malicious link. All that's needed is a vulnerable WordPress installation which is exposed to the public internet.

What WordPress Versions Are Affected?

WordPress 6.8 - 6.8.5 is affected by the unauthenticated SQL injection issue. WordPress 6.9 - 6.9.4 and 7.0 - 7.0.1 are affected by both vulnerabilities. WordPress versions prior to 6.8 are not affected.

Update To The Appropriate Patched Versions

If your site is running WordPress 6.8 - 6.8.5, 6.9 - 6.9.4 or 7.0 - 7.0.1, you should look to update to the appropriate patched versions 6.8.6, 6.9.5 and 7.0.2 and as soon as possible, if your site hasn't already updated.

Where a site can't be updated immediately, it's recommended to:

  • Install a plugin that blocks anonymous access to the REST API entirely; or
  • Block /wp-json/batch/v1 and ?rest_route=/batch/v1 at a WAF level.

as a temporary measure until the site can be updated to the latest WordPress branch version the site is running.

What Happens If You Don't Update?

The wp2shell chain allows an attacker to gain full admin rights through the SQL injection. Once the attacker has an admin account they can log in and perform a full site takeover including executing code with system level privileges.

Searchlight Cyber, who found the vulnerability, published a full technical analysis of wp2shell.

Exploitation Of Sites Begins

Various websites have reported that exploitation activity began within hours of the WordPress core updates being released.

Wordfence reported that "attackers were not merely scanning for the existence of the /wp-json/batch/v1 endpoint. They observed endpoint probing and SQL injection attempts the same evening, and public proof-of-concept code was reported in the days that followed."

Addendum: Later in its "Exploit Technical Analysis and Real Attack Data" WordFence said it had "blocked over 11 million exploit attempts targeting this vulnerability".

Patchstack also published that they were "watching attackers weaponize the WordPress core RCE" and "the first real exploitation attempts hit Patchstack sensors roughly 90 minutes after 7.0.2 was released, three hours after the fix was committed." Patchstack go onto say that they "blocked more than 65,000 exploitation attempts against these two vulnerabilities, from more than 1,500 unique IP addresses."

If your site is already compromised you will need to set about cleaning and securing your site.

Set Your Site To Auto Security Update

WordPress releases minor secuirity updates when it discovers new vulnerabilities. You can set your WordPress core to update automatically for security and maintenance releases by default. If your site was changed and you need to turn this setting back on, you can do so using your site dashboard or by editing your configuration file:

  • Go to your WordPress Dashboard and click on Dashboard > Updates. Check if it says your site is set to manual updates. If so click the link that says Switch to automatic updates for maintenance and security releases to sett he site to default to updating when a WordPress core security update is released.
  • Alternatively, access your website files and open the wp-config.php file in your main WordPress folder. Add the line of code define( 'WP_AUTO_UPDATE_CORE', 'minor' ); just above the line that says /* That's all, stop editing! */ and save the file.

The 'minor' setting tells WordPress to install security and maintenance fixes automatically while leaving major updates for you to approve.

A Final Word

A question being asked is: "Does this make WordPress unsafe?" The answer is NO. An unauthenticated remote code execution in WordPress core like the wp2shell chain is extremely rare, having happened only a handful of times in the 25-year history of the platform and the first time in the last decade.