--- title: wp2shell: WordPress Patches a Pre-Auth RCE That Needed... description: WordPress has patched a critical pre-authentication remote code execution vulnerability dubbed wp2shell (CVE-2026-63030), affecting versions 6.9.0–6.9.4 and... canonical: https://daily.dev/posts/wp2shell-wordpress-patches-a-pre-auth-rce-that-needed-no-plugins-pmh9adxqu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: wp2shell: WordPress Patches a Pre-Auth RCE That Needed No Plugins | daily.dev og:description: WordPress has patched a critical pre-authentication remote code execution vulnerability dubbed wp2shell (CVE-2026-63030), affecting versions 6.9.0–6.9.4 and... og:url: https://daily.dev/posts/wp2shell-wordpress-patches-a-pre-auth-rce-that-needed-no-plugins-pmh9adxqu og:image: https://api.daily.dev/og/posts/pMH9adxQU.png og:image:alt: wp2shell: WordPress Patches a Pre-Auth RCE That Needed No Plugins og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # wp2shell: WordPress Patches a Pre-Auth RCE That Needed No Plugins **[Latest Hacking News](https://daily.dev/sources/lhn)** · 4 min read · 2 upvotes · 0 comments ## Summary WordPress has patched a critical pre-authentication remote code execution vulnerability dubbed wp2shell (CVE-2026-63030), affecting versions 6.9.0–6.9.4 and 7.0.0–7.0.1. The flaw chains a REST API batch-route confusion bug with SQL injection, requiring no login, no plugins, and no special configuration to exploit. A second unrelated critical SQL injection (CVE-2026-60137) was fixed in the same release. WordPress activated forced auto-updates to push patches to affected sites. No confirmed in-the-wild exploitation has been found yet, but a public PoC is considered highly likely given the open-source diff. Defenders should verify all internet-facing installs received the update, and as a temporary mitigation, block the batch endpoint at the WAF layer. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the wp2shell vulnerability in WordPress and which versions are affected? Wp2shell, tracked as CVE-2026-63030, is a WordPress core vulnerability chaining a REST API batch-route confusion bug with SQL injection to give an unauthenticated attacker remote code execution with no plugins involved. It affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, exploitable through the batch endpoint at /wp-json/batch/v1 or the query-string alias ?rest_route=/batch/v1. It was patched in versions 6.9.5 and 7.0.2. _Track core CVEs like wp2shell on daily.dev to keep WordPress patch schedules ahead of exploitation._ ### How does WordPress's severity rating for CVE-2026-63030 compare to the GitHub Security Advisory rating? WordPress's own release notes classify the wp2shell batch-endpoint chain as high severity, but the GitHub Security Advisory for the same bug, GHSA-ff9f-jf42-662q, rates it Critical with a CVSS score of 7.5. Rapid7 uses the GHSA framing throughout its advisory and warns against triaging patches using WordPress's internal severity field alone, since it can under-rank a pre-auth RCE requiring no authentication. _Compare conflicting vendor and CVE severity labels on daily.dev before deciding which patches to prioritize._ ### What should WordPress site owners do if they cannot immediately update to fix CVE-2026-63030? Rapid7 recommends blocking the batch endpoint at the WAF layer as a stopgap, covering both the REST path /wp-json/batch/v1 and the query-string alias ?rest_route=/batch/v1, since either one reaches the same vulnerable code. Site owners can also check exposure with a public checker at wp2shell.com. Rapid7's Exposure Command and InsightVM tools added checks for CVE-2026-63030 starting July 20, but a WAF rule is only a bridge to patching, not a replacement. _Keep stopgap mitigations and patch timelines straight for critical WordPress bugs with daily.dev._ ## Similar posts on daily.dev - [CVE-2026-1357: WordPress Plugin RCE Exposes Sites to Full Takeover](https://daily.dev/posts/cve-2026-1357-wordpress-plugin-rce-exposes-sites-to-full-takeover-fq2jk89o7) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#sql](https://daily.dev/tags/sql), [#wordpress](https://daily.dev/tags/wordpress), [#rest-api](https://daily.dev/tags/rest-api) [View this post on daily.dev](https://daily.dev/posts/wp2shell-wordpress-patches-a-pre-auth-rce-that-needed-no-plugins-pmh9adxqu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"wp2shell: WordPress Patches a Pre-Auth RCE That Needed No Plugins","url":"https://daily.dev/posts/wp2shell-wordpress-patches-a-pre-auth-rce-that-needed-no-plugins-pmh9adxqu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/wp2shell-wordpress-patches-a-pre-auth-rce-that-needed-no-plugins-pmh9adxqu"},"datePublished":"2026-07-26T19:12:35.042Z","dateModified":"2026-09-13T20:06:35.035Z","description":"WordPress has patched a critical pre-authentication remote code execution vulnerability dubbed wp2shell (CVE-2026-63030), affecting versions 6.9.0–6.9.4 and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/11b427ee3a0a5f1bfb424d6c333d94cf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/11b427ee3a0a5f1bfb424d6c333d94cf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Latest Hacking News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Latest Hacking News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5110318ded6e43f1bb12facdeb2b1965","url":"https://daily.dev/sources/lhn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/wp2shell-wordpress-patches-a-pre-auth-rce-that-needed-no-plugins-pmh9adxqu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,sql,wordpress,rest-api","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Latest Hacking News","item":"https://daily.dev/sources/lhn"},{"@type":"ListItem","position":3,"name":"wp2shell: WordPress Patches a Pre-Auth RCE That Needed No Plugins"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/wp2shell-wordpress-patches-a-pre-auth-rce-that-needed-no-plugins-pmh9adxqu#faq","mainEntity":[{"@type":"Question","name":"What is the wp2shell vulnerability in WordPress and which versions are affected?","acceptedAnswer":{"@type":"Answer","text":"Wp2shell, tracked as CVE-2026-63030, is a WordPress core vulnerability chaining a REST API batch-route confusion bug with SQL injection to give an unauthenticated attacker remote code execution with no plugins involved. It affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, exploitable through the batch endpoint at /wp-json/batch/v1 or the query-string alias ?rest_route=/batch/v1. It was patched in versions 6.9.5 and 7.0.2. Track core CVEs like wp2shell on daily.dev to keep WordPress patch schedules ahead of exploitation."}},{"@type":"Question","name":"How does WordPress's severity rating for CVE-2026-63030 compare to the GitHub Security Advisory rating?","acceptedAnswer":{"@type":"Answer","text":"WordPress's own release notes classify the wp2shell batch-endpoint chain as high severity, but the GitHub Security Advisory for the same bug, GHSA-ff9f-jf42-662q, rates it Critical with a CVSS score of 7.5. Rapid7 uses the GHSA framing throughout its advisory and warns against triaging patches using WordPress's internal severity field alone, since it can under-rank a pre-auth RCE requiring no authentication. Compare conflicting vendor and CVE severity labels on daily.dev before deciding which patches to prioritize."}},{"@type":"Question","name":"What should WordPress site owners do if they cannot immediately update to fix CVE-2026-63030?","acceptedAnswer":{"@type":"Answer","text":"Rapid7 recommends blocking the batch endpoint at the WAF layer as a stopgap, covering both the REST path /wp-json/batch/v1 and the query-string alias ?rest_route=/batch/v1, since either one reaches the same vulnerable code. Site owners can also check exposure with a public checker at wp2shell.com. Rapid7's Exposure Command and InsightVM tools added checks for CVE-2026-63030 starting July 20, but a WAF rule is only a bridge to patching, not a replacement. Keep stopgap mitigations and patch timelines straight for critical WordPress bugs with daily.dev."}}]} ```