Critical WordPress Remote Code Execution Vulnerability (“wp2shell”) Affects 500+ Million Websites

Key Takeaways

• A critical WordPress core vulnerability chain could enable unauthenticated remote code execution.
• Public proof-of-concept exploit code is available.
• No plugins, credentials, or user interaction are required for exploitation.
• Organizations should apply vendor-recommended updates immediately.
• Temporary mitigations should only be used until patches can be deployed.

Beyond addressing the immediate vulnerability, organizations should evaluate whether their broader cybersecurity programs, incident response processes, and vulnerability management practices are designed to address emerging threats.

Executive Summary

Security researchers have identified a critical WordPress core vulnerability chain known as “wp2shell” that could affect more than 500 million websites. The vulnerability enables unauthenticated remote code execution (RCE) against default WordPress installations and requires no plugins, custom configurations, user interaction, or prior access to exploit.

Because public proof-of-concept (PoC) exploit code is available, organizations should prioritize patching affected systems immediately or implement temporary mitigation measures if patches cannot be deployed promptly.

Understanding the Vulnerability

The wp2shell attack chain consists of two vulnerabilities, CVE-2026-63030 and CVE-2026-60137. When chained together, these vulnerabilities enable a pre-authentication RCE attack against vulnerable WordPress core installations. An attacker does not require valid credentials, user interaction, plugins, or special site configurations to exploit the flaw.

The vulnerabilities function as follows:

• CVE-2026-63030 allows an attacker to bypass security controls that normally restrict access to sensitive WordPress functionality.
• CVE-2026-60137 is a SQL injection vulnerability that enables malicious manipulation of database queries.

While each vulnerability is serious on its own, chaining them together could allow an attacker to:

• Execute arbitrary code remotely
• Create unauthorized administrator accounts
• Install malicious plugins or web shells
• Modify website content and configurations
• Gain persistent access to the affected environment

Who Is Affected?

Organizations running affected versions of WordPress core, including default installations, may be vulnerable to the wp2shell attack chain. Because exploitation does not require authentication or additional plugins, organizations should prioritize remediation of internet-facing WordPress websites.

Immediate Actions to Protect Your Organization

Organizations should immediately update affected WordPress installations according to the table below: