A default, unmodified WordPress (WP) website can be completely compromised with no login or plugin installation required. Attackers are already gaining remote code execution, and security teams are urging users to update immediately.

Unceremoniously dubbed wp2shell, the WordPress exploit is nearly as bad as it gets: unauthenticated remote attackers are gaining remote code execution with no special conditions.

Only the latest versions of WordPress, published since December last year, are vulnerable:

• WordPress 6.9.0 – 6.9.4, fixed in 6.9.5
• WordPress 7.0.0 – 7.0.1, fixed in 7.0.2
• WordPress 7.1 beta, fixed in 7.1 beta2

“It is recommended that you update your sites immediately,” WordPress urges in a security advisory.

“Due to the severity, the WordPress.org team has enabled forced updates via the auto-update system for sites running affected versions.”

The exploit results from two separate vulnerabilities introduced independently as unrelated bug fixes earlier.

Searchlight Cyber’s security research team, which discovered the vulnerabilities, estimates that over 500 million websites use WordPress. While the team did not release any technical details to prevent immediate exploitation, malicious activity has already been observed in the wild.

Cloudflare, a major content delivery and security company, has deployed emergency Web Application Firewall (WAF) protections to reduce the risk of any potential exploitation.

What are the bugs?

The hackers are chaining two bugs to achieve remote code execution on WordPress servers.

WordPress uses the REST API for communication between clients and the server. REST API includes a feature – batch processing – for bundling multiple API requests into a single HTTP request.

The batch feature can be called publicly with no specific permissions, but it fails to sanitize the subrequests it is bundling. The critical route confusion vulnerability (CVE-2026-63030) has a severity rating of 9.8 out of 10.

“A route confusion flaw causes the arrays containing the sub-requests, validation results, and matched handlers to become misaligned,” explain researchers at Hacktron, a cybersecurity platform.

In simpler terms, attackers can send crafted batch requests and access internal WordPress API functionality. The bug causes WordPress to lose track of which requests were properly validated, allowing a request that should be blocked to be treated as trusted.

“No login or user interaction is required to exploit this vulnerability,” Cloudflare said.

Another flaw, CVE-2026-60137, is a 9.1 out of 10 SQL injection vulnerability. Attackers can chain it with the first bug to alter database commands and gain remote code execution.

In isolation, this SQL injection vulnerability wouldn’t be directly exploitable. The first bug gives attackers access to the internal API, the second enables them to pass untrusted input, leading to RCE.

Ironically, the two bugs comprising wp2shell were introduced to WordPress independently while trying to fix unrelated minor bugs. The SQL injection vulnerability is present from version 6.8 onwards, and the batch endpoint route confusion issue appeared in WP version 6.9.

How to protect your site?

Searchlight Cyber has released a tool for administrators to check if their websites are affected.

Updating WordPress is the recommended mitigation. However, if it’s not immediately possible, the researchers recommend installing the plugin Disable WP REST API, which prevents unauthenticated users from using the WordPress API but might break existing functionality.

The website also shares a code for a custom plugin that can be dropped and enabled on the WordPress instance.

Another option is to use a WAF to block the path /wp-json/batch/v1 and the query parameter rest_route=/batch/v1 – both of these patterns must be blocked to secure your instance, Searchlight Cyber warns.

“Note that these solutions may have an impact on the legitimate use of the site and should only be considered emergency temporary measures until you can update,” the researchers warn.

Despite the researchers holding back the full working exploit code, public proofs-of-concept are circulating, and multiple security firms have confirmed exploitation in the wild. Defenders suggest checking logs for requests hitting the affected batch endpoints, especially from suspicious user agents like wp2shell-check or similar.

Cybernews previously reported that most WordPress sites are left outdated because administrators fear that updates often break site functionality and cause compatibility issues.