In early October 2026, security researchers disclosed a chained vulnerability in WordPress core itself — not a plugin, not a theme, the actual core software running underneath every WordPress site. Nicknamed “wp2shell” by several research teams, the chain allows a completely unauthenticated attacker to achieve remote code execution. WordPress force-pushed fixes through its automatic update system, but it’s worth understanding exactly what happened and confirming your own sites are actually patched.
How the chain works
The attack combines two separate flaws:
- CVE-2026-63030 — a route-confusion bug in the REST API’s
/batch/v1endpoint. Researchers classify it as an interpretation conflict: a specially crafted anonymous request can slip past the authentication checks that are supposed to guard other, more sensitive endpoints. - CVE-2026-60137 — a SQL injection vulnerability in WP_Query, WordPress core’s central query-building class.
Neither flaw alone is catastrophic on its own terms, but chained together, the route-confusion bug lets an anonymous request reach the SQL injection that’s normally gated behind authentication. The result is unauthenticated remote code execution against any un-patched WordPress installation.
Who’s affected and what’s fixed
The affected range covers WordPress core 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Fixes shipped in 6.8.6, 6.9.5, and 7.0.2. Because this is core WordPress software, the automatic background update system pushed the fix to all supported installations without site owners needing to act — but “pushed” isn’t the same as “confirmed installed,” especially on sites where auto-updates have been disabled or are failing silently.
CISA has added this chain to its Known Exploited Vulnerabilities catalog, and a public proof-of-concept now exists, which means the pool of attackers capable of using it just got much larger. Sources differ on severity scoring — WPScan cites CVSS 9.8, while the GitHub security advisory lists 7.5 — but both numbers describe a serious, actively weaponized flaw.
How to confirm your site is actually patched
- Check your WordPress version in wp-admin under Dashboard > Updates, or via WP-CLI with
wp core version. - Confirm it reads 6.8.6, 6.9.5, 7.0.2, or later — anything below those numbers in the affected ranges is still vulnerable.
- If auto-updates are disabled (common on sites with custom deployment pipelines or managed hosting that locks core updates), update manually right away.
- Check your hosting provider’s update logs or your site’s own activity log to confirm the automatic update actually completed rather than failing silently.
Why this one matters more than a typical plugin CVE
Plugin vulnerabilities only affect sites running that specific plugin. A core vulnerability affects every WordPress site that hasn’t patched, regardless of which plugins or theme you run — which is exactly why it ended up on CISA’s exploited list and why multiple independent security vendors (Akamai, Rapid7, NetSPI) all published their own analysis within days of disclosure. If you manage WordPress sites for clients, this is worth a version check across your entire portfolio, not just the sites you remember updating recently.