what is wp2shell? the WordPress bug that lets a total stranger take over a default site, explained

It's the nickname for a critical flaw in WordPress core — two vulnerabilities chained into a full site takeover with no login required. Here's what… Aliteq Priya Nair · Software & Systems Editor

wp2shell is a critical, pre-authentication remote code execution (RCE) vulnerability in WordPress core, disclosed July 17, 2026. It chains CVE-2026-63030 (a REST API batch-endpoint route confusion)…

"Pre-authentication" means no login required — the attacker needs nothing but network access to your site.

It affects a default install: no vulnerable plugin or theme needed, unlike most WordPress flaws.

Affected versions: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 for the full RCE chain. Fixed in 6.9.5 / 7.0.2.

Rated CVSS 9.8 (Critical) by WPScan; discovered by Adam Kues at Assetnote (Searchlight Cyber) and disclosed responsibly via WordPress's HackerOne program.

One quirk spares some sites: the exploit needs no persistent object cache (Redis/Memcached) and at least one published post to work.

Read the full story

Aliteq what is wp2shell? the WordPress bug that lets a total stranger take over a default site, explained Read the full story on Aliteq