17 July 2026 · 4 min read · News
On 17 July 2026 WordPress shipped emergency patches for a vulnerability in its core that picked up the nickname wp2shell. It lets an attacker run code on a default WordPress site without logging in. No account, no vulnerable plugin, no special configuration. A regular site on an affected version is enough, and that makes the vulnerability serious.
We did not discover wp2shell ourselves. The finding comes from Adam Kues of Assetnote / Searchlight Cyber, who reported it through WordPress’s HackerOne program and published the public testing tool wp2shell.com. The researchers are deliberately withholding the exploit details so administrators have time to patch. Even so, we managed to rebuild a working proof-of-concept in six minutes with Claude Code. More on that below.
The gist of this article is short. Check which WordPress version you run and update it. Below you can read what exactly is going on and how to fix it.
wp2shell is not a single flaw but a combination of two vulnerabilities in WordPress core that together lead to remote code execution (RCE).
author__not_in parameter of the internal WP_Query class. Unsanitised input ends up in the database query. This flaw has been present since WordPress 6.8 and is rated CVSS 9.1 (critical) by Searchlight./wp-json/batch/v1 endpoint bundles multiple requests, and because of confusion over which route is invoked, an attacker reaches the SQL injection without authentication and turns it into code execution. This part affects WordPress from version 6.9.An attacker sends a crafted request to the batch endpoint, uses the SQL injection to gain control over the query, and runs code on the server, without ever logging in.
WordPress is the most popular CMS in the world and powers a large share of all websites. A flaw in its core therefore affects essentially every default installation on an affected version, regardless of which plugins or themes it runs. Because no authentication is required and the vulnerable endpoint sits in the same place on every site, the flaw is easy to scan for at scale. Vulnerabilities like this are typically mass-exploited within days of disclosure. A successful attack means code execution on the web server, and with it access to your database and the rest of your environment.
The researchers did not release the exploit details. Based on the clues that were published and the testing tool on wp2shell.com, we built a working proof-of-concept in a sealed-off test environment with Claude Code in six minutes.
We are deliberately not sharing that PoC. We publish no exploit code and no step-by-step guide, so this article does not become a weapon against sites that are not yet patched. Credit for the finding stays entirely with wp2shell.com and Searchlight Cyber.
What it does show is how fast things move. The time between a known vulnerability with withheld details and a working exploit has dropped to minutes. So do not count on having days. Treat this vulnerability as if it is already being scanned for, and update today.
Check which version you run via Dashboard → Updates, at the bottom of the admin screen, or in your site’s generator meta tag. Compare it against the table below. The researchers offer a testing tool on wp2shell.com; use it only on sites you own.
| WordPress version | Vulnerable to | Fixed in |
|---|---|---|
| Older than 6.8 | Not vulnerable | — |
| 6.8.x | SQL injection only (CVE-2026-60137) | 6.8.6 |
| 6.9.0 – 6.9.4 | Full pre-auth RCE | 6.9.5 |
| 7.0.0 – 7.0.1 | Full pre-auth RCE | 7.0.2 |
| 7.1 beta (up to beta1) | Full pre-auth RCE | 7.1 beta2 |
If you run 6.9 or 7.0, updating to 6.9.5 or 7.0.2 is the top priority. If you are still on 6.8, you are only exposed to the SQL injection, but updating to 6.8.6 is recommended there too.
There is only one fix that counts. Update WordPress to a patched version (6.9.5, 7.0.2, 6.8.6 or 7.1 beta2). You can do this via Dashboard → Updates, with WP-CLI (wp core update) or through your hosting provider. Enable automatic core updates while you are at it, so the next emergency patch does not leave you days behind again.
If updating right away is not possible, you can temporarily block the /wp-json/batch/v1 endpoint on your firewall or WAF. Cloudflare did this by default for all its customers, including the free plan. That reduces the risk but does not replace the update. The chart below shows which step fits your situation.
We check whether your WordPress environment is vulnerable to wp2shell and hunt for the weak spots automated scanners miss. Get in touch with no obligation to discuss the options.
Get in touchOr email us directly at [email protected]
Lateral movement is how an attacker moves from system to system after the initial breach, on the way to domain admin. We show the risk in your network.
AS-REP roasting cracks the password of Active Directory accounts that have Kerberos pre-authentication disabled, offline and often without having to log in.
Kerberos is the authentication protocol of Active Directory, based on tickets and a central KDC. We show how it works and where attackers abuse it.