It's the nickname for a critical flaw in WordPress core — two vulnerabilities chained into a full site takeover with no login required. Here's what it is, whether you're affected, and what to do, in plain English.
wp2shell is the nickname security researchers gave to a critical vulnerability in WordPress core that lets an attacker with no account take complete control of a default WordPress site. The name is a pun — "WordPress to shell," where getting a shell means running your own commands on someone else's server. It isn't one bug but two, chained together: CVE-2026-63030, a routing flaw in WordPress's REST API, feeds into CVE-2026-60137, a SQL injection in WordPress's database layer. On their own each is a problem; together they turn a single anonymous web request into a full server takeover. That's the whole story in one paragraph — the rest of this page is the detail, and where to go deeper on each part.
0.0/ 10
CVSS severity: Critical
Rated 9.8 by WPScan — near the maximum a vulnerability can score.
What each half of wp2shell does
The reason wp2shell is dangerous is that neither vulnerability alone would be catastrophic, but the combination is. Think of it as a locked building: the first bug props open a side door that should have stayed shut, and the second bug is a weakness in the room that door leads to. Individually, a propped door with nothing valuable behind it is a nuisance; a vulnerable room behind a locked door is theoretical. Chain them and you have a break-in.
The two CVEs that make up wp2shell
CVE-2026-63030
What it is
REST API batch route confusion
What it does
Mis-routes an anonymous request to a more privileged handler than intended
CVE-2026-60137
What it is
SQL injection in WP_Query (author__not_in)
What it does
Lets the mis-routed request inject database commands
Chained result
What it is
Pre-auth RCE
What it does
An anonymous attacker runs code on the server — full takeover
What it is
What it does
CVE-2026-63030
REST API batch route confusion
Mis-routes an anonymous request to a more privileged handler than intended
CVE-2026-60137
SQL injection in WP_Query (author__not_in)
Lets the mis-routed request inject database commands
Chained result
Pre-auth RCE
An anonymous attacker runs code on the server — full takeover
How the wp2shell chain reaches code execution
Anonymous request
One HTTP call to the REST API batch endpoint. No login, no plugin.
Route confusion
wp_parse_url() fails mid-batch, so later requests run under the wrong handler (CVE-2026-63030).
SQL injection
The misrouted request reaches WP_Query's author__not_in parameter (CVE-2026-60137).
Code execution
Database write is escalated to running the attacker's own code — a shell.
Full takeover
The attacker controls the site and the server under it.
Anonymous request
One HTTP call to the REST API batch endpoint. No login, no plugin.
Route confusion
wp_parse_url() fails mid-batch, so later requests run under the wrong handler (CVE-2026-63030).
SQL injection
The misrouted request reaches WP_Query's author__not_in parameter (CVE-2026-60137).
Code execution
Database write is escalated to running the attacker's own code — a shell.
Full takeover
The attacker controls the site and the server under it.
Each stage feeds the next — neither half is a full takeover alone. That's what makes it a chain.
If you want the deep version — how the batch endpoint gets confused, why author__not_in is the weak point, and what "route confusion" actually means at the code level — we broke the whole chain down step by step in how wp2shell works. For most site owners, the mechanism matters less than the two questions that follow: am I affected, and what do I do?
Am I affected?
This is the question that actually matters, and the answer is more nuanced than "any WordPress site." The full remote-code-execution chain only works on specific versions, and even then a couple of preconditions have to be true. Here's the honest breakdown, drawn from the official advisory:
WordPress shipped 6.9.5 and 7.0.2 on July 17, 2026 and took the rare step of forcing auto-updates to contain wp2shell. · WordPress.org (screenshot)
Why wp2shell is a bigger deal than most WordPress bugs
WordPress vulnerabilities are common — thousands a year — but almost all of them live in plugins and themes, not core. wp2shell is the rare exception: a critical flaw in WordPress itself, which means it threatens a default install with no add-ons required. We put that in context — 96% of WordPress vulnerabilities are in plugins, and a core flaw like this one is both rarer and scarier because you can't just uninstall the vulnerable component. There is no component to remove; the fix is patching WordPress.
It's also being used. A working proof-of-concept appeared on GitHub within a day of disclosure, and security firms reported exploitation attempts in the wild shortly after. That combination — trivial to exploit, affects default installs, publicly weaponised — is why WordPress broke its own "we don't touch your site" rule and pushed a forced update to the whole affected population. The rating agencies put it at CVSS 9.8, the near-maximum, and for once that number isn't inflated.
wp2shell: how it unfolded
Jul 17
Adam Kues (Assetnote / Searchlight Cyber) responsibly discloses the chain via WordPress's HackerOne; WordPress ships 6.9.5, 7.0.2 and 6.8.6.
Jul 18
A public proof-of-concept lands on GitHub; WordPress triggers forced auto-updates for affected versions.
Jul 18–20
Security firms report exploitation attempts in the wild; wp2shell enters the standard vulnerability trackers.
What to do about it
Update to WordPress 6.9.5 or 7.0.2 now — verify the version in your admin footer, don't assume an auto-update ran.
If you ran an affected version through the exposure window, check for compromise: unfamiliar admin users, injected content, unexpected files.
Put a WAF in front of your site for the next flaw — it can virtual-patch exploits before you update.
Confirm whether your host or managed platform already patched you — many did it server-side within hours.
It's a nickname, not an official name. 'wp' is WordPress and 'shell' refers to gaining shell access — the ability to run arbitrary commands on a server. So 'wp2shell' is shorthand for 'WordPress to shell,' i.e. going from an anonymous web request to full command execution. The official identifiers are CVE-2026-63030 and CVE-2026-60137, the two vulnerabilities it chains together.
Is wp2shell the same as a plugin vulnerability?
No — and that's what makes it unusual. Most WordPress vulnerabilities are in plugins or themes, so they only affect sites that installed the vulnerable add-on. wp2shell is in WordPress core itself, so it affects a default install with no plugins at all. You can't fix it by removing a plugin; you fix it by updating WordPress. We explain why core flaws are rarer and more serious separately.
Which WordPress versions are affected by wp2shell?
The full remote-code-execution chain affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Versions 6.8.0–6.8.5 have only the SQL-injection half and need a facilitating plugin or theme. WordPress 6.8 and earlier lack the vulnerable batch endpoint entirely, and 6.9.5 / 7.0.2 are patched. Update to a patched version to be safe regardless.
How do I know if my site was hacked via wp2shell?
Check for the fingerprints of a takeover: administrator accounts you didn't create, injected spam or scripts in your content, and PHP files in wp-content/uploads (which should only hold images and documents). Review server logs for unusual requests to the REST API around mid-to-late July 2026. Our full security audit guide walks through this step by step — patching alone doesn't tell you whether someone got in first.
Can wp2shell affect WordPress.com or managed hosting?
WordPress.com and most managed hosts patched or virtual-patched server-side within hours, often before individual owners acted — so those sites were largely protected automatically. Self-hosted sites with auto-updates disabled and no firewall were the exposed group. If you're on managed hosting, verify your version anyway; if you self-host, this is the flaw that rewards keeping auto-updates on.
That's wp2shell: two chained bugs in WordPress core, a full takeover from a single anonymous request, fixed by updating to 6.9.5 or 7.0.2. If you take one action from this page, confirm your version and update. If you want to understand exactly how the exploit works under the hood, we broke down the chain in detail — and if you're securing a site after the fact, start with the security audit.
