Researchers have disclosed wp2shell, a chain of two flaws in WordPress core that lets an attacker run their own code on a default WordPress install — no account, no plugin, no theme required. It affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, versions that were, until the patch landed, running on a very large share of the web.
The chain works in two steps. First, a SQL injection in a core query parameter (now tracked as CVE-2026-60137) lets an attacker manipulate what the database returns. Second, a routing confusion in WordPress's REST API batch endpoint (CVE-2026-63030), introduced when that endpoint was added in version 6.9, lets the attacker turn that database manipulation into arbitrary code execution on the server. Neither bug alone is catastrophic; chained together, they add up to a complete takeover that needs no username or password. Proof-of-concept exploit code is already circulating publicly, which is why WordPress pushed 6.9.5 and 7.0.2 as forced automatic updates rather than waiting for site owners to click "update" themselves.
The earlier SQL injection piece also reaches back into 6.8.0 through 6.8.5, though those versions lack the REST API bug needed to complete the chain into full code execution — still worth patching, just not the emergency the newer versions are.
What this means for your business
- Confirm the auto-update actually landed. WordPress force-pushed 6.9.5/7.0.2 given the severity, but managed hosts that disable core auto-updates, or sites with update hooks overridden by a plugin, can still be sitting exposed. Log in to wp-admin and check the version number under Dashboard → Updates directly — don't assume.
- If you can't patch immediately, block the entry point. The exploit chain runs through
/wp-json/batch/v1. A web application firewall rule blocking anonymous requests to that route (or to the REST API generally, if you don't rely on it) closes the door even before you patch. Cloudflare has already shipped this rule for sites proxied behind it, including free-tier accounts. - Every WordPress site is in scope, not just the obvious ones. This is core, not a plugin — it doesn't matter how minimal or well-maintained your theme and plugin list is. If it's WordPress 6.8 through 7.0.1, it was exposed.
- Ask your web host or agency to confirm, in writing, that this is handled. With public exploits already available, "we'll get to it" is not a safe answer for a pre-auth takeover bug. If nobody can tell you your current WordPress version right now, that's the actual problem to fix.
WordPress still runs a large share of the small-business web, which is exactly why a core bug like this one gets fixed fast and exploited fast in the same week. Patch or WAF today, then check tomorrow that it stuck.