Wp2shell: The Unauthenticated WordPress Exploit That Needs No Login, No Plugins, Just a ...

WordPress patched wp2shell (CVE-2026-63030), a critical pre-authentication remote code execution vulnerability in WordPress core, by releasing versions 6.9.5 and 7.0.2 on July 17, 2026. The flaw allows an anonymous attacker to run code on a default installation, as no plugins, no login, and no user interaction are required.

Yet, administrators should not assume the patch landed automatically – forced pushes can fail on sites with auto-updates disabled, so confirming the update actually applied is essential.

Wp2shell is a chain of two distinct vulnerabilities working together, as SOC Radar also detailed in FAQs for CISOs:

An anonymous attacker reaches the batch endpoint, exploits the route confusion to slip a rogue parameter into WP_Query , and drives the SQL injection through to code execution, turning the two flaws into a full pre-auth compromise.

The complete RCE chain affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. WordPress fixed the issue in 6.9.5 and 7.0.2 and enabled forced automatic updates for affected sites.

Researchers and admins are treating wp2shell as a higher-priority patch due to the cross-component chaining.

Adam Kues of Assetnote, the attack surface management arm of Searchlight Cyber, discovered wp2shell and responsibly disclosed it through WordPress's HackerOne program. As of July 18, 2026, no confirmed in-the-wild exploitation has been reported.

A public proof-of-concept (PoC) demonstrating the SQL injection component has already appeared, capable of reading the database, including administrator password hashes. Cloudflare reported that the vulnerable code path can be reached when a persistent object cache is not in use, which is a common default.

In April, a WordPress Essential Plugin backdoor was disseminated to 20,000+ active WordPress installations.