CVE-2026-63030 Explained: 5 Critical Facts About the WordPress Core RCE (wp2shell)

Last updated: July 19, 2026 — see update note on in-the-wild exploitation reports below.

I checked three different WordPress installs the morning this dropped, and all three needed the same fix. That’s usually a bad sign — and this time it was.

On July 17, 2026, WordPress quietly pushed out 6.9.5 and 7.0.2. No fanfare, no changelog drama, just a routine-looking update notice. Underneath it sat CVE-2026-63030, a vulnerability researchers nicknamed “wp2shell” — and it’s not a plugin issue you can just deactivate your way out of. It lives in WordPress Core itself, in the REST API’s batch request handling, and it doesn’t ask for a password first.

That last part is what makes this one worth stopping and reading properly, even if you’re tired of “critical” CVE headlines by now.

Before we get into the details, here’s the whole chain in one picture:

Notice the dashed box — that’s deliberate. Searchlight Cyber confirmed the chain but withheld exact exploitation detail, so this stays at the conceptual level rather than pretending to know steps that haven’t been published.

What CVE-2026-63030 Actually Is

Here’s the official release notice — no drama, just a version bump that quietly closed one of the more serious core vulnerabilities this year.

WordPress 7.0.2, released July 17, 2026 — the patched version for this vulnerability chain.

The official description from the CVE record is refreshingly plain: WordPress versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2 are affected by a REST API batch endpoint route confusion issue which, combined with a separate SQL injection flaw (CVE-2026-60137) in WP_Query‘s author__not_in parameter, lets an attacker perform SQL injection and ultimately achieve remote code execution.

Strip the jargon and here’s the plain-English version: two separate bugs, neither devastating entirely on its own, chain together into full server compromise. One is a mix-up in how the REST API matches incoming batch requests to the right handler. The other is an old SQL injection pathway that, until now, nobody unauthenticated could actually reach. WordPress 6.9 accidentally opened the door to it.

That core-level exposure is exactly why the caching detail below matters — it’s one of the few things that can change your exposure without a WordPress update.

The vulnerability was discovered by Adam Kues, a researcher with Searchlight Cyber’s Assetnote team, and disclosed through a GitHub Security Advisory on July 17, 2026. To their credit, Searchlight Cyber made a deliberate call here: they published a free checker at wp2shell.com so site owners could test their own exposure, but held back the full technical breakdown of the exploit chain specifically to give defenders time to patch before attackers had a step-by-step guide. That’s a meaningful distinction from a lot of disclosure writeups that dump full exploitation detail on day one.

Why “Unauthenticated” Changes Everything

A huge share of WordPress vulnerabilities need something first — a logged-in contributor account, a specific plugin combination, a misconfigured setting. CVE-2026-63030 needs none of that. According to Rapid7’s advisory, the vulnerability allows an unauthenticated attacker to execute code via the WordPress REST API batch endpoint, potentially resulting in complete compromise of the website and its underlying data, with no valid account or user interaction required.

That’s the difference between “patch this when you get a chance” and “patch this today.” An attacker doesn’t need to trick anyone, guess a password, or find an exposed admin panel. A single crafted HTTP request to a public endpoint is the entire attack surface.

Affected Versions and What’s Patched

Here’s where a lot of the confusion online comes from, because WordPress 6.8 and WordPress 6.9 are affected differently. Rapid7’s advisory confirms the vulnerability affects WordPress versions 6.9.0 through 6.9.4 and versions 7.0.0 through 7.0.1, and the issue is fixed in 6.9.5 and 7.0.2, with a fix also included in the 7.1 Beta 2 release.

WordPress Version	Affected By	Status
Before 6.8	Not affected by this chain	No action needed
6.8.x	SQL injection component only (CVE-2026-60137)	Update to 6.8.6
6.9.0 – 6.9.4	Full RCE chain	Update to 6.9.5
7.0.0 – 7.0.1	Full RCE chain	Update to 7.0.2
7.1 Beta	Affected beta builds	Fixed in 7.1 Beta 2

The reason 6.8 gets off comparatively lighter: the SQL injection in author__not_in existed there too, but the REST API route confusion that makes it reachable by an anonymous attacker was only introduced in 6.9. If you’re on 6.8, you still need to patch — just know you were never exposed to the full RCE chain the way 6.9 and 7.0 sites were.

The CVSS Score Confusion (And Why It Exists)

If you’ve looked this CVE up on more than one site, you’ve probably noticed the severity score doesn’t agree with itself. That’s not a typo anywhere — it’s a genuine split between scoring bodies. WPScan, acting as the CVE Numbering Authority for this record, rated it 9.8 Critical. CISA’s enrichment data (listed as ADP on the NVD record) rated the same vulnerability 7.5 High. As of this writing, NIST’s own NVD assessment is still marked “not yet provided.”

If you want to see the discrepancy in black and white, here’s the actual NVD record showing both ratings side by side:

Two different enrichment sources, two different numbers — both looking at the same underlying flaw.

The gap comes down to scope. The 7.5 rating reflects the REST API confusion bug considered somewhat in isolation; the 9.8 rating accounts for the full chained impact once you factor in what the SQL injection component enables downstream. Rapid7’s own advisory, published while the score was still settling, noted the vulnerability has currently been assigned a CVSS score of 7.5 — worth mentioning if you’re citing a number, since which one you quote depends on which source enriched the record.

What We Actually Know About the Attack Path

I want to be straightforward about something here, because a lot of write-ups on this CVE are already filling in blanks that the researchers themselves left empty on purpose. Searchlight Cyber’s own advisory states plainly that, given the severity of the bug and to give defenders time to patch, they are not releasing technical details at this time — offering the wp2shell.com checker instead so site owners can test exposure without a full exploit walkthrough being public.

Here’s that statement directly from the source, in case you want to see it isn’t paraphrased:

This is also where their free vulnerability checker lives, if you want to test your own site without needing exploit details.

What that means practically: any article online right now claiming to show you the exact vulnerable code, a step-by-step exploitation script, or a confirmed working proof-of-concept is either working from unverified secondhand claims or filling gaps that the original researchers deliberately left unfilled. I’d treat those pieces with real caution — and honestly, so should you, whether you’re reading them for curiosity or considering testing anything against a live site.

What is confirmed is the mechanism at a conceptual level: the REST API’s batch request handler mismatches which request gets validated against which route, and that confusion creates a path to the pre-existing SQL injection in WP_Query. From there, the SQL injection is severe enough to enable remote code execution. This overlaps conceptually with weaknesses we’ve covered in unrestricted file upload vulnerabilities — different mechanism, same end result of an attacker gaining code execution on a server that should never have allowed it.

The CWE Classification

The official record maps this to CWE-436: Interpretation Conflict — a weakness category describing exactly this kind of scenario, where different parts of a system interpret the same input or state differently, and that mismatch becomes exploitable. If you want the fuller picture of how weakness classifications like this connect to specific vulnerabilities and attacker techniques, our breakdown of CVE vs CWE vs CAPEC walks through exactly that relationship using a similar real-world case.

If you’d rather watch this play out than read another paragraph, here’s a walkthrough covering the same disclosure:

The details here match what Searchlight Cyber and Rapid7 have published — no exploit code shown, same as the official advisories.

What To Do Right Now

Step 1: Check your version. Log into wp-admin, look at your WordPress version in the dashboard footer, or run wp core version if you manage things via CLI.

Step 2: Update immediately if you’re on an affected version. WordPress pushed this as a forced security release for a reason — go to Dashboard → Updates and confirm you’re on 6.9.5, 7.0.2, or later.

Step 3: Don’t assume auto-update succeeded. File permission issues and disk space problems can silently stall an update. Verify the version number after updating, not just that you clicked the button.

Step 4: Check every instance, not just your main site. Staging environments, old client demos, and forgotten microsites running WordPress are exactly the kind of thing that stays unpatched for months and becomes the entry point.

Step 5: If you genuinely can’t patch immediately, a Web Application Firewall rule blocking both /wp-json/batch/v1 and ?rest_route=/batch/v1 buys you time. Cloudflare deployed new WAF rules for all customers, including free and paid plans, at 17:03 UTC on July 17, 2026 — so if your traffic already routes through Cloudflare, you may already have some coverage. Treat this as a stopgap, not a substitute for patching.

This is the same defense-in-depth thinking that applies to REST API and backend exposure generally — a WAF rule can slow an attacker down, but it’s never the actual fix. If you want the deeper context on why API-layer trust assumptions keep causing this class of problem, it connects directly to the mistakes we cover in API and firewall security practices.

How This Compares to a Typical Plugin CVE

Most of the CVEs we cover here affect a single plugin — patch it, disable it, move on. This one is different in scale specifically because it’s core. WordPress estimates power a huge share of the web, and Searchlight Cyber’s own advisory notes it is estimated that over 500 million websites use WordPress — meaning a core-level, unauthenticated RCE has a genuinely different blast radius than even a widely-installed plugin flaw. We’ve written before about how CVE-2026-4020’s unauthenticated exposure played out in a single plugin’s API layer — this is the same category of mistake, just one level deeper in the stack.

Frequently Asked Questions