On this page

WordPress wp2shell: update core and check for compromise

By Tornike@realtornikeoPublished Nov 4, 2026Last updated Nov 4, 2026

Original sources: WordPress: security release and branch fixes; WordPress: SQL injection advisory; Searchlight Cyber: wp2shell research and temporary mitigation; Coalition: honeypot activity and exposure conditions

Does this apply to me?

WordPress 6.86.8.0 through 6.8.5: Standalone SQL injection requires untrusted input to reach the affected WP_Query author__not_in parameter, for example through a plugin or theme.Action: 6.8.6
WordPress 6.9 and 7.06.9.0 through 6.9.4; 7.0.0 through 7.0.1: The unauthenticated chain can affect a stock installation without plugins.Action: 6.9.5 or 7.0.2 for the respective branch
WordPress 7.1 beta7.1 beta before beta2: The beta is affected by both flaws.Action: 7.1 beta2

How severe is it?

Critical: unauthenticated code execution

A successful chain can give an attacker code execution on the site. Coalition reported exploitation attempts against its honeypots on July 20. Those observations do not establish that a particular production site was compromised.

WordPress rates the combined issue Critical. Its SQL injection advisory rates the standalone issue Moderate. My assessment is that exposed sites need prompt remediation and investigation.

First reported Jul 17, 2026

CVE-2026-60137CVE-2026-63030

What happened

WordPress disclosed two core vulnerabilities on July 17, 2026. The wp2shell chain combines SQL injection with REST API route confusion and can lead to unauthenticated remote code execution. Searchlight Cyber says the chain can affect a stock installation without plugins.

The SQL injection is CVE-2026-60137. CVE-2026-63030 provides the REST API route confusion used in the chain. WordPress 6.8 has the SQL injection issue alone; the full chain affects the listed 6.9 and 7.0 releases.

What to do now

Update each affected installation to its fixed branch release or a later release containing the fixes. WordPress enabled forced automatic updates, but verify the version actually running.
If an update must wait, review Searchlight Cyber's temporary guidance for blocking anonymous access to the batch API. Test site functionality and apply the update as soon as possible.
For sites exposed while vulnerable, review access logs, administrator accounts and recent plugin or file changes. Investigate signs of unauthorized access; patching alone cannot remove an existing compromise.

What this means for your website

The affected code is in WordPress core, so a site can be exposed even without a vulnerable plugin. Inventory production, staging and forgotten installations, and verify the running version on each host.

Sources and updates

This brief reflects the sources checked on Nov 4, 2026. Follow the linked vendor notices for subsequent corrections and updates.

Find your own weak spots.

Test your live website and give your coding agent evidence it can act on.

Set up your agent →