Updated July 18, 2026: the two flaws now carry CVE IDs, the full mechanism has been published, a persistent-object-cache condition has surfaced, and a working proof-of-concept is public. The story below reflects all of it. An anonymous HTTP request can run code on a WordPress site. The bug is in core, so a bare install with zero plugins is exploitable. Every 6.9 and 7.0 site was in range until Friday, when WordPress shipped 6.9.5 and 7.0.2 and enabled what it calls forced updates through its auto-update system. wp2shell is two bugs, not one, and both now carry CVE IDs. CVE-2026-63030 is the REST API batch-route confusion; CVE-2026-60137 is a SQL injection in WordPress core. Chained, they take an anonymous request all the way to code execution. Since Friday, the full mechanism has been published, and a working proof-of-concept has gone up on GitHub. Adam Kues at Assetnote, Searchlight Cyber's attack surface management arm, found the batch-route bug and reported it through WordPress's HackerOne program. The writeup, published under the name wp2shell, says the attack has "no preconditions and can be exploited by an anonymous user." The SQL injection was reported separately by TF1T, dtro, and haongo. Searchlight is still holding its own technical write-up and pointed owners to a checker at wp2shell.com. The reticence is beside the point now: the patch is public, and other researchers read it. The two bugs do not reach the same versions, and that is the key to who is exposed to what. The injection goes back to 6.8. The batch-route confusion, the half that turns a bounded injection into unauthenticated RCE, only exists from 6.9 on. So the ranges split: - 6.8.0 through 6.8.5: SQL injection only, fixed in 6.8.6 - 6.9.0 through 6.9.4: full RCE chain, fixed in 6.9.5 - 7.0.0 through 7.0.1: