WordPress force-pushed an emergency security update to all supported installations on July 17 after Searchlight Cyber disclosed WP2Shell, a pre-authentication remote code execution chain against WordPress core that Wordfence has described as the first of its kind in nearly a decade.
Working exploits and initial signs of in-the-wild activity emerged within days.
The chain combines CVE-2026-63030, a critical REST API batch-route confusion flaw added in WordPress 6.9, with CVE-2026-60137, an SQL injection present since WordPress 6.8. Chained, they let an unauthenticated attacker achieve code execution against a default install with no plugins required.
The full chain affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1; 6.8.x carries only the SQL injection. Fixes were shipped in 6.8.6, 6.9.5, and 7.0.2.
The batch-route flaw was discovered by Adam Kues, a researcher at Assetnote (part of Searchlight Cyber), who used OpenAI’s GPT-5.6 Sol Ultra model to analyze WordPress core and generate a working exploit. The SQL injection component was reported separately by researchers credited as TF1T, dtro, and haongo.
WordPress’s decision to force-push updates through the auto-update system is unusual. Cloudflare deployed WAF protections against both CVEs across all plans within a day.
Weaponized Within a Day
The speed of weaponization is what makes this disclosure significant. Wiz Research reported that 60% of organizations running WordPress had at least one vulnerable instance when the CVEs dropped, and around 25% had at least one vulnerable internet-facing server. Both figures roughly halved within 24 hours as teams patched.
Administrators should immediately verify the fixed version is installed and check REST API logs at /wp-json/batch/v1 for anomalous batch requests.
Wordfence and Cloudflare have both published detection guidance. WordPress’s force-push has effectively closed the typical four-week enterprise patch window for sites connected to auto-updates.
