A critical zero-day in WordPress Core is putting over 500 million websites at risk of full takeover. We are already detecting it.
What's the vulnerability?
WP2Shell (CVE-2026-63030/CVE-2026-60137) is a pre-authentication remote code execution flaw discovered by Searchlight Cyber's research team. It requires no preconditions and can be exploited by an anonymous, unauthenticated attacker against a stock WordPress install. No plugins, no credentials, no user interaction needed.
The root cause sits in the REST API's /batch/v1 endpoint: a batch-route confusion issue that, chained with a SQL injection, lets an attacker escalate straight to remote code execution. A single anonymous request to the batch API is enough to take over the site.
Given the scale of the impact (WordPress powers an estimated 500M+ sites), Searchlight Cyber withheld full technical details to give defenders time to patch. At Ethiack, we were able to reverse this CVE and can confirm that the SQL injection is possible on a default Wordpress installation, fully unauthenticated.
PoC
Remote Code Execution can be achieved by cracking the WordPress admin password that can be extracted with the SQL injection, which may not be feasible given Wordpress password requirements, but other methods may exist.
Here's a video of such an exploit running:
Which versions are affected?
- WordPress 6.9.0 through 6.9.4
- WordPress 7.0.0 through 7.0.1
- WordPress ≤ 6.8.5 is not affected
What should you do?
Immediate action: Upgrade to a patched version:
- WordPress 6.9.5
- WordPress 7.0.2
- Also backported to 6.9.5, 6.8.6, and 7.1 Beta 2
Can't upgrade right away? The original reporters mentioned that you can also block anonymous access to the batch API as a temporary emergency measure:
- Install a plugin that blocks anonymous access to the REST API entirely, or
- Block /wp-json/batch/v1 and ?rest_route=/batch/v1 at your WAF
Note both mitigations may affect legitimate site functionality and should only be used until you can patch.
How Ethiack helps
Our continuous testing now detects wp2shell across your attack surface. It'll identify WordPress instances and validate exploitable vulnerabilities, so you know exactly where you're exposed and what needs fixing.