Public exploits released for WordPress core flaws that give anonymous code execution

Public exploit code is now available for wp2shell, a pair of WordPress core flaws that chain into pre-authentication remote code execution against a stock site with no plugins installed. CVE-2026-63030 is a route confusion bug in the REST API batch endpoint, which has shipped enabled by default since 2020, and CVE-2026-60137 is a SQL injection in the author parameter handling of WP_Query. Chained, an anonymous HTTP request can run code on the server. The chain affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, fixed in 6.9.5 and 7.0.2, and WordPress enabled forced automatic updates given the severity.

Check

Confirm every WordPress site you run, including forgotten and staging instances, is on 6.9.5 or 7.0.2 or later, then check logs and web directories for web shells.

Affected

Any site on WordPress 6.9.0 to 6.9.4 or 7.0.0 to 7.0.1 (CVE-2026-63030, CVE-2026-60137); no plugins, login, or user interaction are needed, and working exploits are public.

Fix

Update to WordPress 6.9.5 or 7.0.2, confirm auto-updates applied, put a web application firewall in front of exposed sites, and treat unpatched internet-facing installs as potentially compromised.