Cybersecurity

One Request Could Hijack Your WordPress Site

On 17 July 2026 WordPress shipped forced updates 6.9.5 and 7.0.2 to close wp2shell (CVE-2026-63030), a pre-authentication remote code execution flaw in core that an anonymous request could trigger on a default install. Why the automatic patch is not where your job ends.

CybersecurityBy Servola Tech Desk2026-07-183 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

One Request Could Hijack Your WordPress Site

Key takeaways

On 17 July 2026 WordPress released forced automatic updates 6.9.5 and 7.0.2 to fix wp2shell (CVE-2026-63030), a pre-authentication remote code execution flaw in core that a single anonymous request could trigger on a default install with no plugins.
The flaw sits in WordPress core, not a plugin, so roughly 40 percent of all websites were exposed by default rather than through an unusual add-on.
Because attackers needed no login, the update that closes the hole does nothing for a site already compromised in the exposure window; the automatic patch removes the vulnerability, not a webshell left behind.
A second critical bug, CVE-2026-60137, is a SQL injection in WP_Query rated CVSS 9.1 that reaches back to WordPress 6.8, widening how long some sites were exposed.
Under NIS2 and the GDPR the burden is on you to show the window was not exploited, which turns 'we auto-updated' into the start of an investigation, not the end of one.

What wp2shell actually does

When Adam Kues at Assetnote sent a specially crafted request to a stock WordPress install, the server ran his code. No account, no password, no plugin, no unusual setting. The researchers named the chain wp2shell, WordPress assigned it CVE-2026-63030, and both parties rated it critical.

The exploit strings together two weaknesses in the REST API batch route: a request-routing confusion that lets an unauthenticated caller reach code paths meant to be gated, and a SQL injection reachable through it. Chained, they turn an anonymous HTTP request into remote code execution, the most severe outcome a web flaw can have.

Why the automatic patch is not the finish line

WordPress shipped 6.9.5 and 7.0.2 on 17 July 2026 and, given the severity, forced the updates onto affected sites rather than waiting for owners to click. That is the right call, and most sites are now closed. It also hides the harder question.

A pre-authentication flaw means anyone on the internet could have used it before you patched, and installing the fix does not reverse that. If your site was reachable and unpatched during the exposure window, the update removed the door but not whatever walked through it: a planted admin user, a scheduled task, a webshell in the uploads folder.

Why nearly every site owner is in scope

This lived in core, the software every WordPress site runs, so exposure did not depend on a niche plugin or theme. WordPress powers close to 40 percent of the web, which is why a single core flaw of this class is a mass event rather than a niche one.

Versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 were vulnerable to wp2shell. The second bug, an SQL injection in the author__not_in parameter of WP_Query rated CVSS 9.1, reaches back to 6.8, so a site that skipped updates for a few months carried the larger exposure window of the two.

What EU rules turn this into

For a European business the flaw is not only technical. If personal data sits behind that site, the GDPR gives you 72 hours to notify your supervisory authority once you become aware of a breach, and 'we cannot rule it out' is closer to awareness than to comfort.

For essential and important entities under NIS2, an incident of this severity carries its own early-warning and reporting clock, and regulators increasingly expect evidence of detection, not just a patch log. A forced auto-update is a defence you did not choose; the record of whether you then checked for compromise is the one you control.

The check that has to happen now

Confirm the site is on 6.9.5 or 7.0.2, then treat the exposure window as the real work. Review admin accounts and application passwords created in July, inspect scheduled tasks and recently modified PHP files, and pull web-server logs for unusual POST requests to the REST API around the disclosure date.

If you run managed WordPress, ask your host in writing when the patch landed and whether they saw exploitation attempts against your site. The honest answer to 'were we hit' is rarely instant, but the owners who ask this week are the ones who will not be explaining a silent breach next quarter.

Frequently asked questions

Do I still need to act if my site updated automatically?

Yes. The forced update to 6.9.5 or 7.0.2 removes the vulnerability, but because the flaw needed no login, a site left unpatched during the exposure window could already have been compromised. Confirm the version, then check for new admin users, unexpected scheduled tasks, and modified files.

Does this affect WordPress.com or managed hosting plans?

Managed and hosted platforms typically apply core security releases centrally and patched many customers automatically. Confirm with your provider which version you are on and whether they detected any exploitation attempts, rather than assuming the fix reached your specific site.

What is the difference between the two CVEs?

CVE-2026-63030, called wp2shell, is the pre-authentication remote code execution chain in the REST API and the more urgent of the two. CVE-2026-60137 is a separate SQL injection in WP_Query rated CVSS 9.1 that reaches back to WordPress 6.8. Both are fixed in 6.9.5 and 7.0.2.

The auto-update did the easy part for you. Confirming that nobody used the door before it closed is the part that is actually yours to do.

WordPressCVE-2026-63030wp2shellPre-auth RCEAssetnoteNIS2GDPRPatch management

Eleven Signed Bootloaders Can Bypass Secure Boot

ESET found eleven old Microsoft-signed bootloaders that slip past Secure Boot on almost any PC, with no admin rights needed. Patching them is the easy part. Here is the exposure most fleets never audit.

3 min read

Cybersecurity

570 Windows Patches in One Day, Two Already Exploited

Microsoft fixed 570 flaws on 14 July, nearly three times its June record. Two are already exploited, and a BitLocker bypass weakens your breach defence.

5 min read

Digital Sovereignty

The EU Council Revived the Rule That Scans Private Messages

The EU Council revived the lapsed rule that lets providers scan private messages with AI. For owners, confidential communication is now a governance choice.

2 min read

← All articles