Unauthenticated Exploit Chain Places Countless Websites at Immediate Risk

Newly Discovered Website Weakness Could Allow Complete Server Takeover

Security researchers have disclosed a critical vulnerability in WordPress core that could allow unauthenticated attackers to execute arbitrary code on vulnerable websites, placing millions of installations at risk if they remain unpatched.

The issue, nicknamed "wp2shell," combines two separate vulnerabilities that can be chained together to achieve remote code execution (RCE) on default WordPress installations without requiring authentication. The flaws were patched in WordPress 6.8.6, 6.9.5, and 7.0.2, and the WordPress Security Team has begun automatically updating supported websites.

Two Security Bugs Create a Dangerous Attack Chain

Researchers found that the attack combines:

- CVE-2026-60137 – an unauthenticated SQL injection vulnerability.
- CVE-2026-63030 – a REST API batch request flaw that can elevate the SQL injection into full remote code execution.

When chained together, the vulnerabilities allow attackers to execute malicious code on affected servers without valid credentials, potentially giving them complete control over compromised websites.

Millions of Websites Could Be Affected

Because the vulnerabilities exist in WordPress core rather than a third-party plugin or theme, every site running vulnerable versions is potentially exposed.

Researchers noted that the RCE chain affects WordPress 6.9 through 7.0.1, while the SQL injection flaw also impacts the 6.8 branch. Sites that have not yet installed the latest security updates remain at significant risk.

Public Disclosure Raises Urgency

The technical details behind the attack chain have now been publicly disclosed, and a proof-of-concept exploit has become available, increasing the likelihood of real-world exploitation.

Although the WordPress Security Team issued emergency patches and initiated automatic updates, administrators are encouraged to verify that their websites have successfully upgraded rather than relying solely on the automatic update mechanism.

Immediate Updates Are Strongly Recommended

Security experts advise website owners to:

- Upgrade immediately to WordPress 6.8.6, 6.9.5, or 7.0.2.
- Confirm that automatic updates completed successfully.
- Review server logs for suspicious REST API activity.
- Deploy a web application firewall (WAF) where possible.
- Monitor websites for signs of unauthorized code execution.

Organizations managing internet-facing WordPress deployments should prioritize patching, as vulnerabilities requiring no authentication are frequently targeted soon after public disclosure.

Core Platform Security Remains Critical

The discovery highlights the importance of maintaining up-to-date core software in addition to plugins and themes. As WordPress powers a substantial portion of the web, vulnerabilities affecting the platform itself can have widespread security implications if organizations delay applying security updates.