Somewhere, a WordPress site owner who hasn't logged into wp-admin since 2019 just felt a disturbance in the Force. Security researchers dropped public proof-of-concept exploits this week for a WordPress core vulnerability chain that turns an anonymous HTTP request into full remote code execution — no login required.

Two Small Bugs Add Up to One Big Problem

The chain, dubbed wp2shell, combines two flaws: CVE-2026-63030, a REST API "batch-route confusion" bug introduced in WordPress 6.9 that lets an attacker's request run under a different sub-request's handler, and CVE-2026-60137, a SQL injection hiding in WP_Query's author__not_in parameter that skips its own type check when handed a string instead of an array. Chained together, they take an anonymous visitor straight to code execution on the server.

WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to the full chain; the patched versions are 6.9.5 and 7.0.2. Researchers have already spotted the first signs of in-the-wild exploitation now that working exploits are public on GitHub.

500 Million Sites, One Forced Update

WordPress powers a wide swath of the internet, and "unauthenticated pre-auth RCE in core" is about as bad as WordPress security bugs get — no plugin required, no password to guess. WordPress.org has responded by pushing forced auto-updates to affected sites, and Cloudflare has rolled out WAF rules across all its plans to catch exploitation attempts in the meantime.

If you run a self-hosted site and auto-updates are disabled for "reasons" — a custom plugin that breaks on update, a host that gates it, plain old habit — this is the week to make an exception. Blocking /wp-json/batch/v1 at your firewall buys you time, but it's not a substitute for actually patching.

The internet's favorite CMS just got a reminder that "set it and forget it" is a great slogan and a terrible security strategy.

Source: BleepingComputer