wp2shell: A Pre-Authentication WordPress Core Flaw Australian Sites Should Patch Now
- Jul 30
- 3 min read
A single anonymous HTTP request can run code on a vulnerable WordPress site. The flaw, nicknamed wp2shell, sits in WordPress core rather than a plugin, so even a bare installation with nothing added is in range. WordPress shipped emergency fixes on 17 July, and any Australian organisation running an affected version should treat patching as this week's priority.
What Happened
On 17 July 2026, WordPress released versions 6.9.5 and 7.0.2 to close a pre-authentication remote code execution flaw in its core software, now tracked as CVE-2026-63030. Adam Kues at Assetnote, part of Searchlight Cyber, found the bug and reported it through WordPress's HackerOne programme, publishing it under the name wp2shell. WordPress describes the underlying issue as a REST API batch-route confusion and SQL injection problem that leads to remote code execution, reachable through a batch endpoint that has shipped with core since 2020. Versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected, with the fixes landing in 6.9.5 and 7.0.2 and the same patch carried into the 7.1 beta.
Why It Matters
The researchers say the attack has "no preconditions and can be exploited by an anonymous user" against a default install: no account, no plugin, no user interaction. WordPress underpins a large share of Australian small-business sites, membership portals, non-profits, and government-adjacent services, many of them maintained part-time or not at all. An unauthenticated path to code execution turns each of those sites into a route to the underlying server and the data it holds.
A patch for an open-source project ships the fix and a map to the bug in the same release; the only real question is whether your site updates before someone else reads it.
What Security Teams Should Do Now
Confirm the WordPress version on every internet-facing site you own, including forgotten microsites and campaign pages, and update to 6.9.5, 7.0.2, or later.
Do not assume automatic updates handled it. WordPress is forcing updates for affected installs, but it has not confirmed the push reaches sites with auto-updates switched off, so check the running version directly.
If you cannot patch straight away, block anonymous access to the batch endpoint at your WAF, covering both /wp-json/batch/v1 and the rest_route=/batch/v1 query-string form, since a rule covering only one leaves the other open.
Review logs for unusual POST traffic to the batch endpoint, and treat any hit on an unpatched site as a possible compromise.
Rotate secrets and check for unexpected admin accounts, scheduled tasks, or new files on any site that was exposed before patching.
Fold your WordPress estate into a regular security assessment rather than tracking each site by hand under pressure.
Aurian's Take
This is the recurring shape of open-source risk. WordPress core is public, so once a patch ships, anyone can compare the old and new code and work backwards to the flaw. Searchlight has done exactly that to another vendor's core before, turning a Drupal fix into working proof-of-concept code the same day it was published. Technical details for wp2shell are being held back for now, and no in-the-wild exploitation has been confirmed, but the batch endpoint has been documented publicly for years and the patched files already sit in the release archive. The window between disclosure and mass scanning tends to be measured in days, not weeks.
Content management systems are one of the most common ways Australian organisations get breached, precisely because they sit on the public internet and rarely get the same attention as internal systems. Regular penetration testing and external attack surface reviews exist to find these exposures first: the unpatched CMS on a subdomain nobody remembers, the admin panel reachable from the internet, the integration that quietly re-enabled a risky endpoint. A security assessment that maps what you actually expose, and how quickly you patch it, is worth far more than a scan run once a year. Aurian works with organisations to test that exposure the way a real attacker would.
wp2shell is a reminder that the most dangerous flaws are often the ones sitting on infrastructure you have stopped thinking about. To find out how Aurian can help your organisation assess its exposure, get in touch.
Comments