Individually, these two WordPress Core bugs were mildly annoying. Introduce them to each other, though, and they turn into a full pre-authentication remote code execution chain that doesn't need your password, your plugins, or your permission. Security researchers gave it the nickname "wp2shell," which is either terrifyingly efficient branding or a threat actor's dream tagline.
Two Mediocre Bugs, One Excellent Disaster
The chain pairs CVE-2026-63030, a logic flaw in WordPress's REST API batch processor, with CVE-2026-60137, a SQL injection sitting in the author__not_in parameter of the posts endpoint. On its own, the batch-processor bug just desynchronizes how sub-requests get validated versus dispatched. Combined with the SQL injection, an attacker can misroute a request past authentication checks entirely and pull data straight out of the database — including administrator password hashes.
The chain hits every default WordPress install running 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1, which covers essentially anything updated since December 2025. Fixes shipped in 6.8.6, 6.9.5, and 7.0.2, and both CVEs have already landed on CISA's Known Exploited Vulnerabilities catalog, meaning this isn't theoretical — it's actively being used in the wild.
A Third of the Internet, Give or Take
WordPress powers something like 40% of the web, so "critical, unauthenticated, pre-auth RCE" isn't a niche problem — it's a plumbing problem for the entire internet. Researchers estimate roughly 60% of organizations running WordPress had at least one vulnerable instance when this was disclosed, and a quarter of those were sitting exposed directly on the public internet, essentially waving a flag.
The part that should sting a little: this wasn't some obscure plugin nobody vetted. It's Core. The software running the blog, the store, the client site you set up two years ago and haven't logged into since. If you manage even one WordPress install and haven't checked your version number this week, this is your prompt.
Update now, ask questions later — preferably questions like "wait, when did I last patch this thing?"
Source: The Hacker News