wp2shell Didn't Come From a Plugin. It Came From WordPress Itself.

On July 17, 2026, WordPress shipped emergency releases for two chained vulnerabilities that security researchers named wp2shell. Together they let an attacker with no account, no password, and no user interaction run their own code on a WordPress site. Within days there was working public exploit code, and security firms were reporting attacks in the wild.

Serious WordPress vulnerabilities are not news — thousands are catalogued every year. This one is different for a reason that deserves more attention than the CVE numbers: it did not come from a plugin.

What actually happened

Two flaws in WordPress core, chained together. The first, CVE-2026-63030, is a routing bug in the REST API's batch endpoint: when one request in a batch fails to parse, the internal bookkeeping slips out of alignment, and a later request gets handled with the wrong permission check attached to it. The second, CVE-2026-60137, is a SQL injection reached through a query parameter that only sanitized its input when the input arrived in one particular shape.

Individually, each is a bug. Chained, they walk an anonymous request from the front door all the way to code execution — bypassing the permission check, poisoning what the site believes about itself, and ending with an administrator account the attacker controls. From there it is a plugin upload and the site is theirs.

Affected versions were WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, with the SQL injection also reaching back through 6.8.x. The fixes are 6.8.6, 6.9.5, and 7.0.2. If you run WordPress and have not confirmed your version today, stop reading and go do that first — this post will still be here.

Why this one is different from every other WordPress advisory

For years, the standard defense of WordPress security has been a reasonable one, and we have made a version of it ourselves: the core is maintained by serious people, and the danger lives in the plugin ecosystem. Run fewer plugins. Choose well-maintained ones. Patch quickly. Do that, the argument goes, and you are fine.

wp2shell removes that argument. A brand-new WordPress install, with no plugins, no theme customization, and nothing unusual configured, was exploitable. The REST API batch endpoint is on by default. There was no misconfiguration to blame and no third-party author to point at. A diligent owner who had followed every piece of standard advice was exactly as exposed as a careless one.

That is the part worth sitting with. The mitigation everyone recommends — reduce your dependence on other people's code — had no effect here, because the dependency that failed was WordPress.

The fine print on “just update”

The response from WordPress was fast and genuinely good. Patches shipped for three release branches at once, and automatic updates were force-pushed to installations that had them enabled. Credit where it is due.

But “just enable auto-updates” quietly assumes a site where auto-updates are safe to leave on. On a real business site with a page builder, a forms plugin, a booking integration, and a child theme, unattended core updates are exactly what owners have been taught to fear, because an update that breaks the site at 2 a.m. is its own kind of outage. So a large number of self-managed sites have that switch off on purpose — and those are the sites still exposed right now, with public exploit code circulating.

That is the trap. The platform's complexity is what makes owners disable the safety mechanism, and disabling the safety mechanism is what leaves them vulnerable to the platform's flaws. You cannot patch your way out of a structural problem.

This is the pattern, not the exception

We have written before about how CMS security debt compounds and why pointing AI at WordPress to rescue it is the wrong bet. wp2shell is what those arguments look like when they arrive.

The underlying issue is surface area. WordPress carries two decades of backward compatibility, a REST API that has to serve every plugin ever written, a database layer that has to accept every query shape anyone ever used, and a permission model threaded through all of it. Every one of those commitments is a promise to keep old code working, and every promise is a place where an assumption can quietly stop being true. That is precisely the shape of both bugs in this chain.

Nobody was careless. This is what happens to any codebase asked to be infinitely extensible and permanently backward-compatible for twenty years. It is a property of the architecture, and the next one will come from the same place.

It is time to leave WordPress behind

The honest question is not whether WordPress can be secured — with a competent team, a staging environment, monitoring, and a real patch process, it can be. The question is whether that is a reasonable thing to ask of a business whose actual job is something else entirely.

It is not. Most owners did not sign up to track CVE announcements, evaluate whether an emergency core release will break their booking form, or find out from a customer that their homepage is serving spam. They wanted a website. The maintenance burden was never part of the deal — it was inherited from a platform choice made years ago, often by someone else.

A small, purpose-built site has none of this. There is no REST API surface exposed to the internet for a batch endpoint to confuse. There is no plugin database layer accepting arbitrary query shapes. There is no admin login to escalate into. The attack surface is not smaller by degree — most of it simply does not exist, because the site does not need it to show your customers who you are and let them get in touch.

Where SWATS comes in

SWATS does not build on WordPress. Each site we build is a clean, fast, purpose-built property with no plugin lottery, no theme roulette, and no emergency-patch weekends — and then an agent operates it for you. When something like wp2shell lands, there is nothing for our clients to check, because there is no dashboard, no core version, and no exposed admin surface to check.

And the operating part is the whole point of SWATS: you pitch us your business once, we build the site, and after that updating it is as simple as sending an email. The part you love is the only part you do.

Want to know where your site actually stands? Run the free SWATS Scorecard and see if you're visible — or invisible — to AI search.

This is the way. 🤖

— Jenaro Diaz, Founder & CEO, SWATS AI