Critical WordPress Core Vulnerability Now Under Active Attack, No Login Required

A critical vulnerability chain in WordPress core, nicknamed wp2shell, is now being actively exploited in the wild, according to security firm Patchstack, which recorded attack attempts starting just before 7:00 PM ET on Friday — hours after WordPress shipped an emergency patch. The flaw needs no user account, no vulnerable plugin, and no unusual configuration: a completely default WordPress installation running an affected version can be taken over by a single anonymous request.

The chain combines two separate bugs. CVE-2026-60137 is a SQL injection sitting in a core database-query function, one that WordPress had deliberately restricted to logged-in users only. CVE-2026-63030 is a flaw in how the REST API's batch endpoint — a feature that has shipped by default in every WordPress site since 2020 — matches incoming requests to their permission checks. On its own, that batch-endpoint bug quietly breaks the authorization check meant to keep the SQL injection locked behind a login. Chained together, the two let anyone on the internet reach the database and, from there, execute code on the server: the most severe outcome a website compromise can produce.

WordPress powers roughly two out of every five websites globally, which is what turns a core bug into a mass event rather than an isolated incident. Versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to the full remote-code-execution chain; version 6.8 is exposed to the SQL injection alone. WordPress released fixed versions 6.9.5, 7.0.2 and 6.8.6 on July 17 and, given the severity, force-enabled automatic updates on affected sites rather than waiting for administrators to act manually.

The researcher who found the flaw, Adam Kues of Searchlight Cyber, initially withheld technical details to buy site owners time to patch. That window closed fast: public proof-of-concept exploits appeared on GitHub within a day of disclosure, and real attacks followed within hours of that. Cloudflare has pushed WAF rules to block known exploitation patterns for customers on its platform, but has been explicit that this is a stopgap, not a substitute for patching.

Anyone running a self-hosted WordPress site should confirm right now, without waiting for an automatic update to run on its own, that the site shows version 6.9.5, 7.0.2, or 6.8.6 in its dashboard. Given how quickly this one moved from disclosure to active exploitation, a delayed update is no longer a theoretical risk.