Imagine sitting relaxed over coffee, having your favorite AI model open, throwing in $25 in API credit, and 10 hours later holding an unauthenticated Remote Code Execution (RCE) for the world's most widely used CMS in your hands. YAY!
This is exactly what Adam Kues (Security Analyst at Searchlight Cyber) is happening. The result listens to the smooth name wp2shell and is an actively exploited exploit chain that currently rolls over millions of WordPress instances. Security-Insider.de has already Reported in detail on 27.7.
If you're running WordPress and haven't updated since mid-July, now The moment to put the coffee away and open the terminal.
The institution is on fire: What is wp2shell?
In the case of: wp2shell This is not just a simple bug, but a Exploit chain Two vulnerabilities in the WordPress core. Together they allow Unauthenticated RCE, which means an attacker doesn't need any credentials or special status on your site. A prepared HTTP request is enough to execute any PHP code and take over the server completely.
The attackers don't waste time: Already 13 minutes After publication of the Security patches by WordPress on 17.7 security companies such as Defiant registered the first automated SQL injection probes on the network.
The anatomy of the exploit: What Happens Under the Hood
For those who want to know more about how the rabbit works: Here, the interaction of the two vulnerabilities is simplified:
[ Unauth Request ] │ ▼ [ REST API Batch-Endpoint ] (CVE-2026-63030: Route Mapping Flaw) │ ├─ Bypass von Auth / Routing-Restrictions ▼ [ WP _Query Engine ] (CVE-2026-60137: SQL Injection via 'author __not _in') │ ├─ Unadjusted parameter leverages SQL sanitization from ▼ [ Remote Code Execution / Webshell ] │ └─ File in /wp-content/cache/ with random hash name
You will find all the technical details in the contributions of Searchlight Cyber and wizz.io
The door opener: REST API Batch Routing (CVE-2026-63030)
- CVSS Score: 9.8 (Critical)
- Affected versions: WP 6.9.x (< 6.9.5) & 7.0.x (< 7.0.2)
WordPress provides the ability to bundle multiple requests into a single call through its REST API batch endpoint. There was a logical error in the Route mapping. This allowed attackers to send requests to internal/protected endpoints that would normally require authentication.
The payload supplier: SQL Injection in WP _Query (CVE-2026-60137)
- CVSS Score: 5.9 (means)
- Affected versions: WP 6.8.x (< 6.8.6), 6.9.x (< 6.9.5) & 7.0.x (< 7.0.2)
The classic: The parameter Author __not _in in the central query class WP _Query It has not been properly sanitized. If this parameter is fed with unfiltered inputs (e.g. triggered by a plugin or the above-mentioned REST API gap), a classic SQL injection is created.
The combination: The 2-step principle
Security researcher Johannes B. Ullrich (SANS Institute) illustrated by an example, how the wave of attacks works in practice:
- Sample / recon: The attacker sends a first payload via SQLi to check whether the database is writable and whether the gap is working.
- Webshell dropper: A PHP webshell is pressed into the file system via SQLi – typically in the directory
/wp-content/cache/under a randomly generated MD5/SHA name (e.g.a8f3b...php). - Stealth mechanism: The file name also serves as an authentication token. If you unload the webshell without the appropriate URL parameter, it will freeze a fake URL.
HTTP 404 Not Foundback. Smart!
Once the shell is in place, bots load malicious plugins, read the wp-config.php from (Hello database credentials!), create new administrator users or insert malicious code via manipulated CDN scripts.
AI in the bug bounty game: The $25 Joker
A spicy detail on the edge: Adam Kues called his writeup provocative:
“Exploit brokers pay 500,000 $ for a WordPress RCE. I have one with GPT-5.6 Sol Ultra and 25 $ found.’
He used the Large Language Model specifically for static code analysis and sifting through diff commits of the WordPress core. What used to occupy teams of security researchers for weeks, a specialized AI does today in a few hours for change.
For admins, this means: The time-to-exploit is shrinking massively. The time between patch release and fully automated mass scans is now in the minutes range.
First aid: Are you affected & what to do?
Quick check via website: https://wp2shell.com/
Step 1: Update (NOW!)
WordPress released the patched version on July 17, 2026 7.0.2 (or backports) 6.9.5 and 6.8.6) published. If your auto update didn't work: Immediately toast manually.
Step 2: IoC-Check (Indicators of Compromise)
If you want to know if someone has already settled in with you, check your instance for the following abnormalities:
/wp-content/cache/Browse: Watch out for fresh.phpFiles with cryptic names in the cache folder. Cache folders should usually none It contains executable PHP code.- Check admin users: Check out the WordPress pattern list (
/wp-admin/users.php?role=administrator) to unknown accounts. Attackers like to create inconspicuous admins. - Log file analysis: Filter your web server logs (Nginx/Apache) for suspicious requests
admin-ajax.php, Calls from/wp-json/wp/v2/batchand access to PHP files in thecache/directory.
Step 3: Helpful tools
- The above mentioned Searchlight Cyberwp2shell checker“: Provides a quick remote check for your domain.
- Macnica live dashboard (Yutaka Sejiyama): Tracks the global patch rate. Currently there are ~81.6 % of the examined systems. But this also means: Nearly one in five Page is still open to attack!
Conclusion & Tip for practice
wp2shell Once again, it shows impressively where the journey in the cybersecurity sector is headed: When AI-powered analytics democratize the discovery of 0-days, defenders also need to upgrade.
3 golden rules for your WP server:
- Upload/Cache directory protection: In your Nginx/Apache config, include a rule that
.php-files in/wp-content/uploads/and/wp-content/cache/It is strictly forbidden (location ~* /wp-content/(uploads |cache)/.*\.php$ Deny all; }). - Fail2Ban / WAF use: Set up a web application firewall (e.g. Cloudflare, Wordfence or ModSecurity) to intercept known injection patterns at the edge.
- Check backups: If you had a shell in the system, "patching over" is often no longer enough. Then: Restore system from a clean backup before July 17th and restore all keys in the
wp-config.phpRotate it!
Stay safe & happy patching! What about you? Have you already patched all instances or have you already discovered suspicious accesses in the log? Then let's go!