WordPress RCE Vulnerability Lets Hackers Take Over Sites

A critical WordPress RCE vulnerability is being actively exploited, allowing attackers to take full control of vulnerable websites without a login or user interaction.

The flaw, known as wp2shell, affects default WordPress installations and does not require a vulnerable plugin or special configuration. Security teams are urging administrators to update their sites immediately.

WordPress has released security updates and enabled forced automatic updates for affected versions because of the severity of the issue.

Which WordPress Versions Are Affected?

The WordPress RCE vulnerability affects several recent versions of the content management system.

The following versions require an update:

• WordPress 6.9.0 to 6.9.4 — fixed in version 6.9.5
• WordPress 7.0.0 to 7.0.1 — fixed in version 7.0.2
• WordPress 7.1 beta — fixed in version 7.1 beta2

Older WordPress versions are not affected by the complete attack chain. However, administrators should still keep all installations updated to reduce other security risks.

WordPress powers a large share of the internet, with security researchers estimating that more than 500 million websites use the platform. Therefore, the impact of widespread exploitation could be significant.

Two Flaws Create a Critical Attack Chain

The wp2shell attack combines two separate vulnerabilities that were introduced through unrelated WordPress fixes.

The first issue, tracked as CVE-2026-63030, is a route-confusion vulnerability in the WordPress REST API batch-processing feature. It has a critical severity score of 9.8 out of 10.

Batch processing allows multiple API requests to be sent together. However, the vulnerable feature can reportedly lose track of which requests were properly checked and authorised.

As a result, attackers may be able to access internal API functions that should not be publicly available.

The second flaw, CVE-2026-60137, is a SQL injection vulnerability with a severity score of 9.1. On its own, this issue is not directly exploitable in the same way. However, attackers can combine it with the first flaw to manipulate database queries and achieve remote code execution.

In simple terms, the two bugs allow unauthenticated attackers to run malicious commands on a vulnerable WordPress server.

Attackers Are Already Exploiting the Flaw

Security researchers have withheld full technical details to limit immediate abuse. Nevertheless, multiple security firms have already confirmed that attackers are attempting to exploit the WordPress RCE vulnerability.

Public proof-of-concept material is also reportedly circulating online.

A successful attack could allow criminals to install malware, steal site data, alter website content, create administrator accounts, or use the compromised server in further attacks.

For businesses, the consequences could include website downtime, customer-data exposure, search-ranking damage, and loss of revenue.

How to Protect a WordPress Website

Updating WordPress is the most important step. Site administrators should install the relevant security release as soon as possible and confirm that automatic updates have completed successfully.

Before updating, create a current backup of the website files and database. Then, test essential pages, plugins, forms, payment functions, and integrations after the update.

If an immediate update is impossible, a web application firewall can provide temporary protection by blocking malicious requests to the affected REST API batch endpoint. However, this may affect legitimate website functions.

Administrators can also temporarily restrict unauthenticated access to the WordPress REST API. Again, this should only be treated as a short-term measure because some plugins, themes, and external services may rely on the API.

Finally, website owners should review server and WordPress logs for unusual activity, especially unexpected requests to REST API endpoints, unfamiliar administrator accounts, or suspicious changes to site files.