Security Alert: Urgent Action Required for Critical WordPress Core RCE (CVE-2026-63030)

A critical security vulnerability has been disclosed in WordPress Core that requires immediate attention from all website administrators. Catalogued as CVE-2026-63030 (also known as "wp2shell"), this flaw allows a completely unauthenticated remote attacker to execute arbitrary code on vulnerable installations, potentially leading to a total server takeover.

Here is what you need to know and the immediate steps you must take to secure your sites.

What Is Happening?

On July 17, 2026, a GitHub Security Advisory was published detailing a critical vulnerability in WordPress Core. Discovered by security researcher Adam Kues of Searchlight Cyber, this vulnerability can be exploited remotely against a default WordPress installation without requiring any additional plugins or valid user accounts.

The vulnerability is rated as Critical. While the National Vulnerability Database (NVD) initially assigned it a CVSS score of 7.5, security databases such as Wordfence and other alerts have classified it as a CVSS 9.8 (Critical) due to its unauthenticated, high-impact nature.

How the Exploit Works

The core of the vulnerability lies in a route and validation desynchronisation (or route confusion) within the WordPress REST API batch request engine, located at the /wp-json/batch/v1 endpoint.

1. Validation Bypass: When a batch sub-request is submitted, the system performs validation to ensure the route is permitted. However, due to a flaw in processing logic, an attacker can submit a sub-request that passes initial validation checks - completely bypassing allow_batch security controls.
2. Route Confusion: Once past the initial check, the sub-request is dispatched to a different internal callback handler than intended.
3. Sanitisation Bypass: Because of this desynchronisation, input parameters skip the standard route-level sanitisation. This allows unvetted, malicious parameters to reach the target handlers directly.
4. Remote Code Execution: This lack of sanitisation can be chained with other conditions, such as unauthenticated SQL injection, enabling the attacker to execute arbitrary code on the underlying web server.

Note: According to reports from Cloudflare, the vulnerable code path can only be reached when a persistent object cache is not in use.

Is Your Website Affected?

Your website is at risk if it runs any of the following WordPress Core branches:

• WordPress 6.9.x Branch: Core versions 6.9.0 through 6.9.4
• WordPress 7.0.x Branch: Core versions 7.0.0 through 7.0.1

Note: WordPress versions earlier than 6.9 are not affected by this CVE.

Required Action Steps

Do not wait. Take these steps immediately to protect your digital assets:

1. Update WordPress Core Immediately

Log in to your WordPress Administrative Dashboard and navigate to Dashboard > Updates. Manually trigger an update to WordPress 6.9.5 or WordPress 7.0.2, depending on which branch your site uses.

Crucial Advice: Although the WordPress team is forcing automatic updates for affected installations where auto-updates are enabled, manual verification is mandatory. Do not rely solely on automated controls; always verify that your site is running a patched version (6.9.5, 7.0.2, or higher).

2. Update and Verify Web Application Firewall (WAF) Rules

If you utilise a Web Application Firewall (WAF) (such as Cloudflare, Wordfence, or Sucuri), ensure that your threat intelligence and firewall rules are fully up to date to block malformed REST API batch requests targeting /wp-json/batch/v1.

3. Perform a Security Audit

If your site was running an unpatched version, inspect your system and administration accounts immediately. Look for:

• Unauthorised administrative accounts: Scan for any user accounts with unexpected administrative privileges.
• Manipulated custom roles: If you use role-management plugins, review plugin-defined custom roles, as attackers often leverage these to escalate standard user privileges and maintain persistence.
• Unauthorised plugins: Inspect the wp-content/plugins directory on the server directly, as attackers often hide malicious plugins from the WordPress administrative dashboard.
• Modified core files: Check for unexpected changes to core WordPress files.
• Suspicious activity: Scan for unauthorised code injections or anomalous database activity.

What to Do If You Suspect a Compromise

If you discover unfamiliar admin users, modified files, or anomalous database behaviors, do not attempt to clear logs or restore backups manually, as doing so can destroy critical forensic evidence. Contact our Incident Response Team immediately for a complimentary initial compromise assessment.