WP2Shell Vulnerability: Critical WordPress RCE That’s Actively Hitting NYC Websites

If your small business website runs on WordPress, there’s an urgent security issue you need to address right now. A critical vulnerability dubbed “WP2Shell” has been discovered in WordPress Core — and it’s being actively exploited in the wild by attackers targeting businesses across New York City and beyond.

The vulnerability, tracked as CVE-2026-63030 combined with CVE-2026-60137, carries a CVSS score of 9.8 out of 10 — essentially the maximum possible severity. It allows an anonymous, unauthenticated attacker to execute arbitrary code on your web server, with no plugins required and no special configuration needed.

What makes this vulnerability particularly startling is that it was discovered using OpenAI’s GPT-5.6 Sol by researcher Adam Kues at Searchlight Cyber. In a moment of cybersecurity irony, AI found an AI-generated vulnerability chain that could compromise millions of WordPress sites worldwide.

What Is WP2Shell and Why Does It Matter?

WP2Shell is a two-vulnerability attack chain that works against WordPress Core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Here’s how it works:

1. CVE-2026-63030 (Route Confusion): The REST API batch endpoint at /wp-json/batch/v1 contains a route-matching flaw that allows a request to bypass authentication. This endpoint has been present in WordPress since version 5.6 (2020).
2. CVE-2026-60137 (SQL Injection): A SQL injection flaw in the WP_Query author__not_in parameter, normally only accessible to authenticated users.

When chained together, CVE-2026-63030 bypasses authentication and exposes the SQL injection to anonymous attackers. The result: pre-authentication remote code execution on a default WordPress installation. No plugins. No custom themes. No special setup. Just a plain WordPress install and an attacker with a script.

How the Attack Works in Practice

An attacker doesn’t need to log in, find a vulnerable plugin, or trick anyone into clicking anything. They simply send an automated request to the WordPress REST API, and if the server is running a vulnerable version, they can:

• Read the entire WordPress database, including administrator password hashes
• Crack admin passwords and log in as website administrators
• Upload web shells and backdoors for persistent access
• Modify website content, inject malware, or deface the site
• Use the compromised server to attack other systems

By July 18, 2026 — just one day after the vulnerability was disclosed — a public proof-of-concept exploit was available on GitHub. Within days, researchers at Wiz and watchTowr identified actual exploitation in the wild, with attackers deploying malicious WordPress plugins that execute arbitrary commands through the compromised site.

Why NYC Small Businesses Are a Prime Target

WordPress powers more than 40% of all websites on the internet, and a significant portion of NYC small business websites run on it — from restaurant sites and law firm portals to e-commerce stores and professional service websites.

Small businesses in New York City, Staten Island, and New Jersey are particularly at risk because:

• Many run outdated WordPress versions without automatic update systems in place
• Website owners often lack security expertise and don’t know how to check their WordPress version
• Managed hosting environments with persistent object caches (Redis, Memcached) may still be vulnerable to the SQL injection component, even if the full RCE is blocked
• Many sites store sensitive data — customer information, payment processing, appointment scheduling, and more

Is Your Website Vulnerable? Check Now

To determine if your site is affected:

1. Log into your WordPress dashboard and check Dashboard → Updates for your installed version
2. If you’re running WordPress 6.9.0–6.9.4 or 7.0.0–7.0.1, you are vulnerable
3. If you’re running WordPress 6.8.0–6.8.5, you have the SQL injection component but not the full RCE chain
4. You can also view your website’s source code and look for the meta generator tag: <meta name="generator" content="WordPress/7.0.1">

How to Fix WP2Shell: Immediate Steps

Step 1: Update WordPress Immediately

Update to WordPress 7.0.2 (7.0 branch), 6.9.5 (6.9 branch), or 6.8.6 (6.8 branch). These are the patched versions that close both vulnerabilities.

Step 2: Verify the Patch

After updating, verify your WordPress version through the dashboard and confirm the generator meta tag in your site’s HTML source reflects the patched version.

Step 3: Check for Signs of Compromise

Review your server’s file system for unfamiliar PHP files, check your wp-content/plugins directory for unknown plugins, and review your database for unauthorized users or modifications.

Step 4: Rotate All Credentials

Change your WordPress admin password, database passwords, FTP/sFTP credentials, and hosting control panel passwords. If your site processes payments, contact your payment processor about potential fraud.

Step 5: Install a Web Application Firewall

Implement a WAF that blocks unauthorized access to /wp-json/batch/v1 and /?rest_route=/batch/v1. This provides defense-in-depth even before patching.

Why This Matters for Managed Service Providers

For MSPs managing WordPress sites for clients, WP2Shell represents a critical liability. If any client site is compromised, the attack can pivot to other systems on the network, access email servers, steal client credentials, and cause cascading damage.

MicroSky recommends all MSPs in the NYC area immediately audit their WordPress-based client sites and ensure every installation is updated to the latest version. This is not a vulnerability that can wait for the next patch cycle.

MicroSky’s WordPress Security Approach

MicroSky provides comprehensive WordPress security for small businesses across NYC and Staten Island, including:

• Automated WordPress updates with staging environment testing
• 24/7 vulnerability monitoring and rapid patching
• Web Application Firewall (WAF) configuration and management
• Regular security audits of WordPress installations
• Incident response and remediation services
• Managed hosting with enterprise-grade security

Bottom Line: Patch Now, Protect Always

WP2Shell is not a future threat — it’s actively being exploited right now. The combination of AI-discovered vulnerabilities, public proof-of-concept exploits, and real-world attack data makes this one of the most critical WordPress vulnerabilities in years.

Need help securing your WordPress website? MicroSky’s cybersecurity team in New York City can help you assess your exposure, patch vulnerabilities, and implement ongoing protection. Call us at (718) 672-2177 or visit microskyms.com for a free security consultation. Don’t wait until your website is the next WP2Shell headline.