If you run a WordPress site, a dangerous chain in WordPress core could let an unauthenticated attacker take control of your site. The chain, nicknamed wp2shell, involves two vulnerabilities in WordPress core that were disclosed recently. Here’s what you need to know and what to do now.
What happened
Security researchers disclosed a chain of flaws in WordPress Core, combining CVE-2026-63030 (REST API route confusion) with CVE-2026-60137 (SQL injection). When chained together, this can lead to unauthenticated remote code execution (RCE) on affected sites. The vulnerability affects WordPress Core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. A fix is included in WordPress 6.9.5 and 7.0.2. For sites on the 6.8.x line, there is a narrower risk: 6.8.0 through 6.8.5 are affected only by the SQL injection component, not the full RCE chain. Patches have been released, and upgrading is strongly recommended.
- Impacted: WordPress Core 6.9.0–6.9.4 and 7.0.0–7.0.1.
- Fixed in: 6.9.5 and 7.0.2 (full RCE chain addressed).
- SQL injection component only: 6.8.6 (for sites on the 6.8.x line).
Why it matters
RCE means an attacker could run arbitrary code on a vulnerable site. That can lead to defacement, data theft, the insertion of malware, or taking over the site entirely. The risk is especially real for sites that host e-commerce, membership content, or user data. For developers and IT teams, this is a reminder that core software updates are a daily security practice, not a one-off step.
What you can do now
: go to Dashboard > Updates and confirm you’re on a non-vulnerable core version. : update to WordPress 6.9.5 or 7.0.2. If you cannot upgrade to these quickly, upgrade to 6.8.6 to mitigate the SQL injection component on the 6.8.x line. : take a full backup of your site files and database before applying updates. : if you have a staging site, apply updates there first to check plugin/theme compatibility. : - Limit REST API exposure to authenticated users or specific apps if you don’t rely on public REST endpoints.
- Consider a temporary Web Application Firewall (WAF) rule to block suspicious REST API routes until you patch.
: ensure your extensions are compatible with the new core version. : enable two-factor authentication, rotate admin credentials, and review user permissions. : watch for unusual activity and verify your backups are rotating and restorable.
Final thought
Staying on top of WordPress updates is one of the most practical security habits you can maintain. The wp2shell chain shows how quickly a small set of flaws can become a real risk. A quick patch now can save you bigger headaches later—set aside a few minutes today to update, test, and protect your site.