Published on 31 July 2026
For the first time in almost ten years, there is again a critical security vulnerability in the core of WordPress that an attacker can exploit from the internet – without any credentials, without logging in, and without you having to do anything wrong. It goes by the name "WP2Shell," affects the standard WordPress installation, and has been actively and massively exploited since 17 July 2026. By the end of July, the security firm Wordfence had already blocked over 11 million attack attempts. If your website runs on WordPress, you should read this article to the end – and then act immediately.
On 17 July 2026, the WordPress security team released emergency updates for two related vulnerabilities that became known in combination as "WP2Shell." These are the CVE numbers CVE-2026-60137 and CVE-2026-63030 (CVE = unique identifier for a publicly known security vulnerability).
What makes this special and dangerous: both flaws can be chained together into a so-called Remote Code Execution (RCE) – that is, the execution of arbitrary malicious code on your server from a remote location. With it, an attacker can:
Alexander Thomas of Wordfence puts the significance into perspective:
"wp2shell is one of the most significant WordPress core security events of recent years. The combination of unauthenticated reachability, no plugin or theme requirement, a large global attack surface, a path to administrator access and code execution, along with publicly available proof-of-concept exploits, makes this vulnerability chain unusually serious. This is the first critical unauthenticated remote code execution vulnerability in the WordPress core in almost a decade."
WP2Shell consists of two building blocks that are already bad individually, but devastating in combination.
Via a certain query parameter named author__not_in, a value manipulated by the attacker reaches a database query unfiltered. Normally, WordPress prevents exactly this. Due to a flaw in the validation, however, the safeguard is bypassed, allowing the attacker to read out arbitrary database contents – for example, the table with all users and their password hashes.
WordPress offers a "batch endpoint" via its so-called REST API (an interface through which programs communicate with WordPress). This allows multiple requests to be sent at once. Due to a programming error, the validation and the execution of the requests get out of sync – enabling the attacker to completely circumvent the parameter validation and have requests executed with the wrong permissions.
In the full attack chain, the attacker ultimately manages to trick WordPress into believing they are already logged in as an administrator (user ID 1) – and then creates a genuine new administrator account through which they inject a malicious plugin.
Important to know: the complete RCE path requires that no persistent external object cache such as Redis or Memcached is used (a special technique for caching data). The pure SQL injection, however, works independently of this.
Remarkably, the vulnerability was discovered by security researcher Adam Kues (Searchlight Cyber / Assetnote) with the help of an AI model. According to his own statement, the entire exploit development cost him around 25 US dollars. For comparison: exploit brokers pay up to 500,000 US dollars for WordPress RCE vulnerabilities. Kues writes:
"At this point it became clear to me that I had an exploit for the default configuration of one of the most popular pieces of software in the world. Estimates vary, but most agree that over 500 million WordPress instances are running worldwide."
The following WordPress core versions are affected:
The vulnerability lies in the WordPress core itself – so you are affected even if you have no additional plugins or themes installed. That is precisely what makes this matter so explosive.
With a share of around 41.5% of all websites worldwide, WordPress is by far the most widely used content management system. Germany ranks second worldwide with roughly 1.9 million WordPress websites. The security firm Wiz Research found that 60% of organizations using WordPress had at least one vulnerable instance at the time of publication – and 25% exposed a vulnerable server directly to the internet.
The German Federal Office for Information Security (BSI) published a cybersecurity warning (criticality 3/orange) on 18 July 2026 and rates the combined chain as "critical" with a CVSS score of 9.8. The BSI writes:
"The vulnerabilities are to be assessed as very critical due to the existence of proof-of-concepts (PoCs) and the ease of exploitation, provided automated updates are not used. Exploitation of the vulnerabilities requires no authentication whatsoever."
Go through these steps in order:
wp core version (WP-CLI).wp2_* or w2s_* or email addresses with the domains @wp2shell.invalid or @wp2shell.shellcode.lol./var/log/apache2/access.log, Nginx: /var/log/nginx/access.log), look for POST requests to /wp-json/batch/v1 or ?rest_route=/batch/v1 – in particular from the known attacker IPs (including 103.215.74.26, 103.215.75.66, 103.215.75.19).wp_users and wp_usermeta for unknown admin entries, as well as wp_posts for suspicious oembed_cache and customize_changeset entries with unusually high parent IDs.find /var/www/html -name "*.php" -newermt "2026-07-16".The good news first: WordPress has activated forced automatic updates for affected installations. Many sites have already been protected as a result. However, do not rely on this blindly – manually verify that the update has actually been applied.
wp core update.wp-config.php contains: define('WP_AUTO_UPDATE_CORE', true);/wp-json/batch/v1 and ?rest_route=/batch/v1 via a web application firewall (WAF – a protective layer that filters malicious requests) or .htaccess.Eye Security explicitly warns that an update alone is not enough if your site was already vulnerable beforehand:
"Patching alone isn't enough for anyone who was unprotected before the update. The point of our tools is to answer the harder question of whether the door has already been opened. […] The injection alone can read the wp_users table, which means an attacker may already have your password hashes."
Very serious. The attacks began extremely quickly: as early as 23:29 UTC on the day of the patch release – less than twelve hours later – the first probing attempts against the batch endpoint were recorded. From 18 July, mass exploitation set in. The US agency CISA added CVE-2026-63030 to its catalog of Known Exploited Vulnerabilities (KEV) on 21 July and set US federal agencies a deadline of just three days for remediation – a clear sign of urgency.
Wiz Research already observed active exploitation with persistent web shells (hidden backdoors for remote control), including a 150 KB attack framework named "CMSmap" disguised as a WordPress plugin. István Márton of Wordfence, however, reports a positive sign:
"The Wordfence firewall has blocked over 11 million exploit attempts against this vulnerability. […] When a serious vulnerability affects a large number of websites, we usually see a corresponding rise in compromised sites and support requests. In this case, however, we have not observed such an increase. That is an encouraging sign."
Full proof-of-concept exploits are publicly available. This means that even less technically skilled attackers can exploit the vulnerability. Automated scanning campaigns are searching the entire internet for vulnerable sites.
For German SMEs, this is not just about technology but also about tangible legal obligations. Because if personal data (customer data, order data, contact form entries, comments) were compromised through WP2Shell, the provisions of the General Data Protection Regulation (GDPR) apply:
Practical note: Since WP2Shell enables the reading of password hashes, if you suspect a compromise you should inform all users about the possible exposure of their credentials – even if these have not yet been cracked.
WP2Shell is the most serious WordPress core vulnerability in almost ten years. It requires no credentials, no user interaction, and no additional plugins – every publicly accessible, unpatched WordPress installation of the affected versions is at risk. Over 11 million blocked attack attempts in just two weeks speak volumes.
The decisive action is simple: Update WordPress immediately to 6.8.6, 6.9.5, or 7.0.2 and manually verify that the update was successful. Then use the free tools from Searchlight Cyber and Eye Security to check whether your site has already been compromised. Anyone who was exposed and unprotected on the internet before the update should assume that attackers may already have had access – and accordingly reset passwords and search for backdoors.
If you are unsure about the check or cleanup, seek professional support. The costs of a delayed response – from complete loss of control over the website to GDPR fines – far exceed the effort of a proper security remediation.