® 
CVE-2026-63030 (wp2shell): Critical WordPress Vulnerability Allows Unauthenticated Remote Code Execution
20 July 2026
CVE-2026-63030 (wp2shell) is a critical WordPress core vulnerability enabling unauthenticated remote code execution. Public PoC is already available. Update to 6.9.5 or 7.0.2 immediately.
CVE-2026-63030, known as "wp2shell", is a WordPress core vulnerability that allows an attacker to execute code remotely without authentication. The attack combines path confusion in the REST batch endpoint /wp-json/batch/v1 (CWE-436) with an SQL injection in the author__not_in parameter of WP_Query (CVE-2026-60137). An anonymous attacker can execute code on a bare installation, without plugins and without an account. WordPress sites exposed to the internet are most at risk: marketing sites, multi-tenant hosting fleets, and customer portals. Working proof-of-concept code is already public.
Official sources disagree on severity. The CNA and NVD record CVSS 9.8 (Critical), while the CISA-ADP assessment marks 7.5 (High). Treat the vulnerability as critical in any case: no authentication required, reachable from the internet, full takeover. Inventory every installation now, including forgotten subdomains and staging environments, and update to 6.9.5 or 7.0.2 today. Cannot patch immediately? Block both /wp-json/batch/v1 and the query parameter rest_route=/batch/v1 on your WAF. Blocking just one is not enough.
The greatest risk is in shared hosting and agency environments, where hundreds of sites operate behind a single control plane. One unpatched installation gives an anonymous attacker read access to the database. Once the admin hash is obtained, a plugin is uploaded and code is executed. On flat networks, that access is then used to move between tenants. WordPress 6.8 is only vulnerable to the SQL injection, so patch that version too.
The window closes fast. From patch to public PoC took less than 48 hours, and Cloudflare delivered WAF rules on the day of disclosure. When a single unauthenticated request is sufficient, mass scanning begins within days.
How DEFION helps
DEFION helps clients map their WordPress exposure, prioritize patching across large environments, hunt for the batch endpoint requests that signal abuse, and brief management when a site has already been compromised. See our Web Application Pentest, Managed Threat Hunting and Incident Response, or contact us to find out what your WordPress exposure looks like.