This is now a known-exploited vulnerability, and the federal remediation deadline has passed. CISA added CVE-2026-63030 to the Known Exploited Vulnerabilities catalog on July 21, 2026, with a remediation deadline of July 24. CVE-2026-60137, the SQL injection it chains with, was added the same day and is due August 4. The original article, published July 18, correctly stated that there was no confirmed in-the-wild exploitation at that time. That changed three days later.
EPSS now scores CVE-2026-63030 at 0.98051, the 99.91st percentile. NVD scores it CVSS 9.8, above the 7.5 originally carried in the GitHub advisory.
In an external exposure review this week, RedEye identified a federal contractor running an affected WordPress version on a public web property, four days past the CISA deadline. If you run WordPress 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1, patch today and then hunt for a web shell, because patching does not undo a compromise that already happened.
- What it is: CVE-2026-63030, nicknamed "WP2Shell," is a pre-authentication remote code execution flaw in WordPress core's REST API batch endpoint (
/wp-json/batch/v1). It works against a stock install with no plugins, no valid account, and no user interaction. Found by Adam Kues at Searchlight Cyber. - Affected and fixed: WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable (7.1 betas too). Fixed in 6.9.5, 7.0.2, and 7.1 Beta 2. Anything 6.8.5 or earlier is not affected.
- Status: No confirmed in-the-wild exploitation yet, and technical details are being held back to give defenders time, but Rapid7 assesses a public proof-of-concept is highly likely within days. Treat this as patch-now.
What WP2Shell is
CVE-2026-63030 lives in WordPress core, not a plugin or a theme, which is what makes it serious. The vulnerable path is the REST API batch endpoint at /wp-json/batch/v1 (also reachable as ?rest_route=/batch/v1), a feature that lets a client bundle several API calls into one request. An unauthenticated attacker can abuse that endpoint to reach code execution on the server. Rapid7 notes the flaw is reachable specifically when a persistent object cache is not in use, which describes the majority of ordinary WordPress installs.
Searchlight Cyber, who reported it, are deliberately withholding the exploit chain for now. That is the right call given the blast radius, but it does not buy you much time: the fix is public, and public fixes get reverse-engineered.
Why this one is bad
Three things stack up. It is pre-authentication, so an attacker needs nothing from you, no credential, no phished admin, no vulnerable plugin. It hits WordPress core, so a default install is enough; you do not have to have installed anything risky. And WordPress runs a large share of the entire web, so the population of exposed targets is enormous. A single crafted HTTP request to a public endpoint that ends in code execution, against that many sites, is exactly the shape of bug that mass-exploitation campaigns are built on.
An RCE like this almost always ends the same way: the attacker drops a PHP web shell into the webroot for persistence, then pivots, harvests credentials from wp-config.php, or stages ransomware. The initial request is the opening move; the web shell is the tell.
Affected and patched versions
- Vulnerable: WordPress 6.9.0 to 6.9.4, 7.0.0 to 7.0.1, and affected 7.1 beta builds.
- Patched: WordPress 6.9.5, 7.0.2, and 7.1 Beta 2.
- Not affected: WordPress 6.8.5 and earlier.
Sites with automatic background updates enabled likely already received 6.9.5 or 7.0.2. Do not assume, confirm the running version.
Exploitation outlook
At the time this article was first published, there was no confirmed exploitation in the wild. That is no longer the case. CISA added CVE-2026-63030 to the Known Exploited Vulnerabilities catalog on July 21, 2026, four days after disclosure, with a remediation deadline of July 24. CVE-2026-60137, the author__not_in SQL injection it chains with, was added the same day with a deadline of August 4. A KEV listing is not a severity opinion, it is CISA's assertion of reliable evidence of active exploitation.
The original assessment was that weaponization would take days rather than months. It took four. Rapid7 Labs had called it, and Rapid7's vulnerability checks went live July 20. EPSS now scores CVE-2026-63030 at 0.98051, the 99.91st percentile of all scored vulnerabilities, which is effectively the ceiling. The window is not opening. It is open.
What to do now
- ImmediateUpdate WordPress
Upgrade to 6.9.5, 7.0.2, or 7.1 Beta 2. The maintainers recommend patching over any workaround. Verify the version after updating rather than trusting auto-update silently ran.
- If you cannot patch this hourBlock the batch endpoint
At your WAF or reverse proxy, deny requests to
/wp-json/batch/v1and?rest_route=/batch/v1. Optionally disable the REST API via a trusted plugin, or add an authentication filter for the batch controller. Treat these as stopgaps until the update lands, not a permanent fix. - OngoingWatch for the shell
Even a patched fleet should be monitored for the post-exploit artifact, unexpected PHP files in the webroot and anomalous requests to the batch endpoint, in case a site was hit before it was patched.
How RedEye and Caver catch it
Patching closes the door; monitoring tells you whether anyone got through first. RedEye ships detection content for this CVE in the RedEye intel feed, covering three observable stages: the exploitation attempt, unauthenticated POST requests to /wp-json/batch/v1 or ?rest_route=/batch/v1; the injection parameter, the author__not_in value carrying the chained CVE-2026-60137 payload; and the post-exploitation artefact, a PHP web shell requested from beneath the uploads directory (MITRE ATT&CK T1505.003).
Worth being precise about the prerequisite, because it is the part most teams get wrong: every stage of this attack lives in HTTP request URIs. If you are not shipping webserver, reverse-proxy or CDN access logs into your SIEM, none of it is visible to you, no matter which product you run. Caver runs this detection wherever that telemetry is onboarded. If it is not onboarded, that is the gap to close first, ahead of any detection tuning.
Sources
Rapid7, "ETR: CVE-2026-63030 WP2Shell," and Searchlight Cyber research by Adam Kues, "WP2Shell: Pre-Authentication RCE in WordPress Core" (July 17, 2026). Vulnerability portal: wp2shell.com. CVE tracked as CVE-2026-63030.
Is your WordPress estate exposed?
RedEye Security runs external exposure reviews and stands up Caver monitoring that flags exploitation attempts and post-exploit web shells in real time.
Talk to RedEye Security