A critical unauthenticated remote code execution vulnerability has been disclosed in WordPress Core, affecting versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The flaw, tracked as CVE-2026-63030 and dubbed wp2shell, has been assigned a CVSS score of 7.5 by the maintainers.
According to the GitHub Security Advisory published on July 17, 2026, the vulnerability allows an unauthenticated attacker to execute arbitrary code via the WordPress REST API batch endpoint. No valid account credentials or user interaction is required for exploitation, making this a serious threat to the millions of websites running the affected versions.
The vulnerable code path can be reached when a persistent object cache is not in use, according to Cloudflare, which reported on the issue. Security researchers at Searchlight Cyber, who identified the vulnerability, stated that it can be exploited remotely against a default WordPress installation without requiring any additional plugins.
The issue has been fixed in WordPress versions 6.9.5 and 7.0.2. A fix is also included in WordPress 7.1 Beta 2. Organizations running affected versions are strongly urged to update immediately.
WordPress powers more than 40% of all websites on the internet, making vulnerabilities in its core software potentially catastrophic. While technical exploit details have not yet been publicly released as of the advisory publication date, security researchers at Rapid7 noted that given the unauthenticated attack path and widespread deployment of WordPress, it is highly likely that a public proof-of-concept will be made available in a short period of time.
Rapid7 Labs assessed that the combination of an open-source codebase and the current ability of AI models to analyze open-source code significantly increases the speed at which working exploits can be developed. Organizations should not interpret the absence of public exploitation reports as an indication of low risk.
References
This article was adapted from Rapid7 Blog. Read the original here.
