A pair of critical flaws in WordPress Core that let an unauthenticated attacker seize full control of a website are now being exploited in the wild, according to a notice from NSFOCUS CERT. The flaw chain, nicknamed "wp2shell," carries a severity score of 9.8 out of 10, and the combination of a public proof of concept exploit and confirmed real world attacks means every unpatched site is now a target.
That is a sharp escalation from the moment the bug was first disclosed on July 17, when researchers warned only that a working exploit "could appear within days." Days later it has, and attackers are already using it.
Why this matters
WordPress powers a very large share of the public web, so a remotely exploitable hole in its core software exposes an enormous number of internet facing sites at once. The attack needs no password, no account, and no clicks from a victim: a single request sent over the network to a default installation is enough.
How the attack works
NSFOCUS CERT describes a two step chain. The first flaw, CVE-2026-63030, abuses the WordPress REST API "batch" endpoint. By bundling several sub requests together, an attacker can confuse the routing logic and slip past the checks that are supposed to block unauthenticated calls. The second flaw, CVE-2026-60137, is a SQL injection bug in the way WordPress handles the author__not_in query parameter. SQL injection means feeding crafted input into a database query, and here it lets an attacker read sensitive data, including administrator password hashes, straight out of the database.
Chained together, the two bugs let an attacker act as an administrator and then abuse the plugin installation feature to drop a web shell, a small backdoor script that hands the attacker remote code execution on the server. From there the whole site, and often the server behind it, falls under the attacker's control.
What is affected
The full remote code execution chain hits WordPress 6.9.0 up to (but not including) 6.9.5, and 7.0.0 up to 7.0.2. The SQL injection flaw on its own also reaches the 6.8 line, from 6.8.0 up to 6.8.6. WordPress 6.8.6, 6.9.5 and 7.0.2 and later are not affected.
What you should do
Update immediately. WordPress has pushed fixes to the affected branches through its forced automatic update mechanism, and site owners can also trigger the update from the dashboard under Update, then Update Now, or by downloading the latest release from wordpress[.]org. Administrators who cannot patch right away can blunt the attack by blocking access to the REST batch API, for example by filtering requests to /wp-json/batch/v1 and ?rest_route=/batch/v1 at a web application firewall, or by installing a plugin that disables anonymous access to the REST API. Because working exploit code is public, treat any delay as exposure: check logs for suspicious requests to the batch endpoint and for newly installed plugins or unfamiliar files.
The warning lands amid a run of critical bugs drawing active exploitation this month, including a SharePoint flaw that CISA flagged as under attack.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.