Which WordPress versions are vulnerable to wp2shell attacks?

Vulnerabilities affect WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Versions 6.8.x are also vulnerable to SQL injection but not the full RCE chain.

How can I protect my WordPress site from these vulnerabilities?

Update WordPress to versions 7.0.2 or 6.9.5 immediately. Temporary measures include blocking REST API access or configuring WAF to filter requests to /wp-json/batch/v1.

Can these vulnerabilities be exploited without authorization?

Yes, the wp2shell attack allows code execution without authentication, making it particularly dangerous for sites with default settings.

← All news

Security

Critical WordPress Vulnerabilities: Public Exploits for RCE Attacks

July 19, 2026

Photo: BleepingComputer

Quick answer

Critical vulnerabilities CVE-2026-63030 and CVE-2026-60137 in WordPress Core allow remote code execution without authentication.

Critical vulnerabilities named 'wp2shell' have been discovered in WordPress Core, enabling attackers to remotely execute arbitrary code on vulnerable sites without authentication. These flaws affect versions 6.9.x and 7.0.x, and public exploits are already available, significantly increasing the risk of attacks.

The issue consists of two vulnerabilities: CVE-2026-63030 (REST API routing flaw) and CVE-2026-60137 (SQL injection in the 'author__not_in' parameter). Their combination allows attackers to gain full control over a site without prior authorization. Experts estimate that over 500 million sites use WordPress, making this vulnerability potentially widespread.

The WordPress team has released patches in versions 7.0.2 and 6.9.5, and automatic forced updates have been activated for vulnerable installations. Temporary protection measures include blocking REST API access or using a WAF to filter suspicious requests. Cloudflare has already added protection against these vulnerabilities to its WAF rules for all plans.

Security experts report that attacks exploiting these vulnerabilities are already being observed in the wild. Site administrators are strongly advised to update their installations as soon as possible to prevent compromise.

Common questions

Which WordPress versions are vulnerable to wp2shell attacks?: Vulnerabilities affect WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Versions 6.8.x are also vulnerable to SQL injection but not the full RCE chain.
How can I protect my WordPress site from these vulnerabilities?: Update WordPress to versions 7.0.2 or 6.9.5 immediately. Temporary measures include blocking REST API access or configuring WAF to filter requests to /wp-json/batch/v1.
Can these vulnerabilities be exploited without authorization?: Yes, the wp2shell attack allows code execution without authentication, making it particularly dangerous for sites with default settings.

Dzen feed: /feed/dzen.xml · RSS: /feed.xml