WordPress WP2Shell Vulnerability (CVE-2026-63030): What You Need to Know and How to Fix It

A critical security issue known as WP2Shell has affected certain versions of WordPress Core and could allow an unauthenticated attacker to execute malicious code on a vulnerable website.

The issue is associated with CVE-2026-63030 and works as part of a vulnerability chain involving CVE-2026-60137. Because the vulnerability exists within WordPress Core itself, a website can potentially be exposed even when it does not use a vulnerable third-party plugin or theme.

Website owners and WordPress administrators should check their installed version and apply the appropriate security update as soon as possible.

What Is WP2Shell?

WP2Shell is the name commonly used for a serious attack chain affecting WordPress Core.

Unlike many WordPress security incidents that originate from outdated plugins or themes, this issue involves functionality built into WordPress itself. The attack combines two separate weaknesses to move from an unauthenticated request toward more serious compromise.

The two vulnerabilities are:

• CVE-2026-63030 – a WordPress REST API batch-processing and route-confusion vulnerability.
• CVE-2026-60137 – a SQL injection vulnerability involving WP_Query.

When combined on affected WordPress versions, these weaknesses can lead to remote code execution (RCE).

Why Is This Vulnerability Serious?

The biggest concern is that exploitation does not depend on an attacker first obtaining a legitimate WordPress account.

A vulnerable installation may be targeted remotely, and the attack chain can operate against WordPress Core without requiring a compromised plugin.

Security researchers reported exploitation of the vulnerability in the wild shortly after the issue became public, making timely patching particularly important.

A successful compromise could give an attacker the ability to manipulate the website or server environment, install malicious code, create persistence, steal information, or use the compromised website for additional attacks.

Which WordPress Versions Are Affected?

The full WP2Shell RCE chain affects these WordPress versions:

WordPress 6.8.x also requires attention because the related SQL injection vulnerability affects versions 6.8.0 through 6.8.5, even though the complete RCE chain is associated with the later 6.9 and 7.0 branches.

How Does WP2Shell Work?

At a high level, the attack takes advantage of weaknesses in WordPress request processing.

The first vulnerability involves the REST API's batch request handling. Under certain conditions, requests can become associated with the wrong route information.

That behavior can then be combined with the SQL injection vulnerability in WP_Query.

The resulting chain can allow an attacker to bypass expected security boundaries and ultimately reach code execution.

The important point for website owners is that this is not simply an ordinary plugin vulnerability. The affected functionality is part of WordPress Core itself.

How Can You Check Your WordPress Website?

First, identify the WordPress Core version currently installed on your website.

You can check it from:

WordPress Dashboard → Updates

You can also find the version information through your hosting control panel or WordPress installation files.

If your website is running an affected release, upgrading should be treated as a priority.

How to Fix WP2Shell

1. Update WordPress Core

The most important step is to upgrade WordPress to a patched release.

For affected 6.9 installations, update to:

WordPress 6.9.5 or later

For affected 7.0 installations, update to:

WordPress 7.0.2 or later

WordPress has released security updates addressing the vulnerabilities.

2. Keep Plugins and Themes Updated

Although WP2Shell affects WordPress Core, outdated plugins and themes can introduce additional security risks.

After updating WordPress, review all installed plugins and themes and remove anything that is no longer required.

Only use software from trustworthy sources and keep active components updated.

3. Review Administrator Accounts

If your website was running an affected version while exploitation was occurring, review your WordPress users.

Look for:

• Unexpected administrator accounts
• Recently created users
• Unknown email addresses
• Suspicious username changes
• Unexpected password resets
• Accounts with administrator privileges that should not have them

An unexpected administrator account can be an indication that the website has been compromised.

4. Check for Suspicious Changes

A security review should also include:

• Recently modified PHP files
• Unknown files inside wp-content
• Unexpected plugins
• Modified theme files
• Suspicious JavaScript
• Unknown scheduled tasks
• Unexpected redirects
• Changes to .htaccess
• Unusual server processes or traffic

If you suspect an active compromise, do not assume that simply updating WordPress has completely cleaned the website.

5. Review Server and Security Logs

Check available:

• Web server logs
• WordPress security logs
• Firewall logs
• Hosting activity logs
• Login records

Look for unusual requests or activity around the period when the website was running a vulnerable version.

A professional security scan can also help identify malicious files or persistence mechanisms.

Can a Firewall Help?

A Web Application Firewall can provide an additional layer of protection.

For example, Cloudflare reported deploying WAF rules designed to protect WordPress applications against the newly disclosed vulnerabilities.

However, a firewall should not be considered a replacement for updating WordPress.

The recommended approach is:

Patch WordPress + secure the server + monitor the website + use WAF protection where appropriate.

What Should Website Owners Do Now?

If you manage a WordPress website, follow this checklist:

1. Check your current WordPress Core version.
2. Update to a patched WordPress release.
3. Update plugins and themes.
4. Remove unused plugins and themes.
5. Review administrator accounts.
6. Check recently modified files.
7. Review available server and security logs.
8. Run a malware/security scan if necessary.
9. Review your hosting and firewall configuration.
10. Create a fresh, verified backup after the website has been secured.

Final Thoughts

WP2Shell is an important reminder that WordPress security is not only about keeping plugins updated. Vulnerabilities in WordPress Core can have a much broader impact because Core functionality is present on virtually every WordPress installation.

If your website was running an affected WordPress version, updating should be your first priority. If the site remained exposed for a significant period or you notice suspicious activity, perform a proper security investigation rather than assuming that an update alone is sufficient.

Keeping WordPress Core, plugins, themes, hosting software, and security controls updated is one of the simplest ways to reduce the risk of future attacks.