WP2SHELL – PwnDefend

Yesterday afternoon/early evening a patch for WordPress was released (7.0.2) which address two vulnerabilities which are named: WP2SHELL. This is a fast post (largely generated by Claude Opus) to provide some detail. For reference in our research we have found ~20% of WordPress sites still vulnerable as of a few hours ago (based on a sample), so this is a live scenario and it would be strongly advisable for organisations to take appropriate steps. This morning I’ve built a docker lab of a vulnerable WordPress site and demonstrated hash theft and web shell deployment to a vulnerable lab instance.

I’ve put some resources for people (use at own risk) into a repo: https://github.com/mr-r3b00t/wp2shell/

that includes a scanner, some info on the vulns and a PoC tool!

TL;DR

On 17 July 2026, WordPress shipped 7.0.2 — a security release that patches two vulnerabilities, including the pre-authentication RCE chain nicknamed wp2shell. It was pushed with forced automatic updates across every affected branch. If you run WordPress, the guidance is blunt: update immediately, and verify you’re actually on a patched version.

What it fixes

Two issues, both in core:

Facilitated SQL injection — CVE-2026-60137 (GHSA-fpp7-x2x2-2mjf). Credited to TF1T, dtro, and haongo.
REST API batch-route confusion + SQL injection → Remote Code Execution — the wp2shell bug, CVE-2026-63030 (GHSA-ff9f-jf42-662q). Credited to Adam Kues at Assetnote / Searchlight Cyber.

Chained together, these give an unauthenticated attacker code execution on a default WordPress install.

Who’s affected and what to run

Branch	Status
7.0.2	Fixes both vulnerabilities ✅
6.9.5	Fixes both vulnerabilities ✅
6.8.6	Fixes the first (SQLi) only ⚠️
7.1 beta 2	Contains fixes for both ✅
Prior to 6.8	Unaffected

Because 6.8.6 only carries the SQLi fix, sites on the 6.8 branch that need protection from the RCE chain should move onto a fully-patched branch.

How to update

Dashboard: Updates → apply 7.0.2.
Manual: download 7.0.2 directly from WordPress.org.
Automatic: background updates were forced on compatible sites — but don’t assume; confirm the running version.

Timeline

Date	Event
Prior to release	wp2shell (CVE-2026-63030) reported by Adam Kues (Assetnote/Searchlight Cyber) via WordPress’s HackerOne; SQLi (CVE-2026-60137) reported by TF1T, dtro, and haongo
17 Jul 2026	WordPress 7.0.2 released — security release patching both CVEs; backports shipped as 6.9.5 and 6.8.6 (SQLi only); fixes also in 7.1 beta 2
17 Jul 2026	Forced auto-updates enabled through the auto-update system across affected branches
18 Jul 2026	No confirmed in-the-wild exploitation reported; full technical details held back to give defenders time to patch

Release credits

Release leads: John Blackbourn and Barry Abrahamson
Contributors: 16+ named contributors, plus representatives from major hosting and technology companies
Security reporters: TF1T, dtro, haongo (SQLi); Adam Kues, Assetnote/Searchlight Cyber (REST/RCE)

Why it matters for defenders

This is a forced-update event, not a routine point release. WordPress rarely compels updates — that alone signals severity.
“Auto-update handled it” is a hypothesis, not a fact. Verify versions across every site you own; sites with auto-updates disabled, or stuck on 6.8.6, are the gap.
Patch closes the door — it doesn’t clean the house. If a site sat exposed before updating, treat it as a potential incident: hunt for webshells, unexpected admin users, and anomalous batch/v1 traffic, then rotate secrets.