Urgent WordPress Security Alert: Update Your Sites Now

👋 Community Lounge
1

Hey guys,

Two serious vulnerabilities were disclosed in WordPress Core on July 17, 2026: CVE-2026-63030 and CVE-2026-60137, together known as “wp2shell.”

When chained together, these vulnerabilities will allow an unauthenticated attacker to create an administrator account and remotely execute code on a WordPress installation. Public exploit code is already available and active exploitation has been reported.

Please update every affected WordPress installation immediately.

Patched versions:

  • WordPress 7.0 → update to 7.0.2 or newer

  • WordPress 6.9 → update to 6.9.5 or newer

  • WordPress 6.8 → update to 6.8.6 or newer

  • WordPress 7.1 Beta → update to Beta 2 or newer

WordPress versions older than 6.8 are not affected. WordPress 6.8 is affected only by CVE-2026-60137, while versions 6.9 and 7.0 are affected by both vulnerabilities.

If you cannot update immediately, temporarily block access to /wp-json/batch/v1 and requests containing rest_route=/batch/v1 through your firewall or web server. Disabling the WordPress REST API can also be used as a temporary emergency measure, but may break plugins or site functionality.

Do not forget staging sites, demos, development installations and abandoned WordPress copies. These are often overlooked but can still be exploited and used to compromise the entire server.

Official details and updates are available in the WordPress 7.0.2 security release announcement.

Please treat this as urgent and update your sites now.

Szabi

2 Likes
2

Thank you for letting us know!

2 Likes
3

Thanks for sharing! looking into this

1 Like
4

Important update: Patchstack has now recorded more than 65,000 exploitation attempts from over 1,500 IP addresses, with the first attacks appearing only 90 minutes after WordPress 7.0.2 was released.

Also, simply blocking URLs containing /batch/v1 is no longer sufficient. Attackers are now placing rest_route=/batch/v1 directly inside the POST body, which can bypass URL-only firewall rules.

If possible, update WordPress immediately. If you were running an affected version after July 17, check for unknown administrator accounts, unfamiliar plugins and unexpected PHP files inside uploads, plugins and especially mu-plugins.

2 Likes
5

This site has a mu-plugin it recommends (helps with POST body attacks): https://wp2shell.com/

They also have a checker but it doesn’t seem to work for me, I always get ‘failed to fetch’.

I’ll just post the plugin here too:

<?php
/**
 * Plugin Name: Disable Unauthenticated REST Batch API
 * Description: Requires an authenticated WordPress user for REST batch requests.
 * Version: 1.0.0
 * Requires at least: 5.6
 * License: GPL-2.0-or-later
 */

defined( 'ABSPATH' ) || exit;

/**
 * Reject anonymous requests to the core REST batch endpoint.
 *
 * @param mixed           $result  Pre-calculated dispatch result.
 * @param WP_REST_Server  $server  REST server instance.
 * @param WP_REST_Request $request Current REST request.
 * @return mixed|WP_Error
 */
function wporg_require_authentication_for_rest_batch( $result, $server, $request ) {
    if ( '/batch/v1' !== strtolower( untrailingslashit( $request->get_route() ) ) || is_user_logged_in() ) {
        return $result;
    }

    return new WP_Error(
        'rest_batch_authentication_required',
        'Authentication is required to use the batch API.',
        array( 'status' => 401 )
    );
}

add_filter( 'rest_pre_dispatch', 'wporg_require_authentication_for_rest_batch', -1000, 3 );
2 Likes