Critical WordPress "wp2shell" Flaws Get Public Exploits, Sites Forced to Update
Security researchers at Searchlight Cyber disclose two critical vulnerabilities in WordPress Core that together enable unauthenticated remote code execution on default installations. Tracked as CVE-2026-63030 and CVE-2026-60137, the flaws affect WordPress versions 6.9.x and 7.0.x. The first vulnerability involves a REST API batch-route confusion issue, while the second is a SQL injection flaw in the WP_Query component's author__not_in parameter.
Because public proof-of-concept exploits now circulate online, the risk to over 500 million WordPress websites grows significantly. An anonymous attacker needs no credentials and no special preconditions to compromise a stock WordPress installation that lacks plugins. The WordPress security team responds by enabling forced automatic updates, an unusual step that underscores the severity of the threat.
Site administrators must verify that their installations run WordPress 7.0.2 or 6.9.5 immediately. While the full remote code execution chain impacts versions 6.9.0 through 7.0.1, the SQL injection component also affects versions dating back to 6.8.0. Administrators who disable automatic updates face the greatest danger and should manually patch without delay.