WordPress wp2shell Flaws Hit 25% of Sites Exposed Online, Driving In-the-Wild RCE
Updated
Updated · Wiz · Jul 21
WordPress wp2shell Flaws Hit 25% of Sites Exposed Online, Driving In-the-Wild RCE
3 articles · Updated · Wiz · Jul 21
Summary
25% of organizations using WordPress had at least one internet-exposed vulnerable server when wp2shell was disclosed, and multiple actors quickly exploited self-hosted cloud instances for unauthenticated code execution.
Attackers abused the /wp-json/batch/v1 and ?rest_route=/batch/v1 endpoints, then uploaded malicious plugins, enumerated users, attempted local file inclusion against wp-config, and reached authenticated /wp-admin sessions.
60% of organizations initially had at least one vulnerable instance, but that fell to 50% within 24 hours; exposed vulnerable servers dropped from 25% to 10% as patching accelerated.
Observed payloads ranged from a one-line PHP webshell that fakes 404 responses to a 150KB "CMSmap" plugin backdoor with file, database, port-scanning and privilege-escalation features.
The RCE chain affects WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1, while a related SQL injection bug hits 6.8.0-6.8.5; defenders are urged to update or block anonymous Batch API access.
How did a critical hackable flaw get into WordPress's core, and what does it mean for API security everywhere?
Is this WordPress vulnerability a warning of a new wave of AI-powered, automated cyberattacks on the web?
Critical "wp2shell" RCE Hits WordPress: What Site Owners Must Do Now to Prevent Mass Exploitation
Overview
On July 17, 2026, a critical remote code execution vulnerability called 'wp2shell' was discovered in WordPress, posing an immediate threat to site security. This flaw targets the REST API, specifically the /wp-json/batch/v1 endpoint, and allows anonymous attackers to execute arbitrary code, risking the integrity of affected sites. The vulnerability is a sophisticated chain of two issues: a REST API batch request handler confusion and an unauthenticated SQL injection. The handler confusion lets attackers manipulate how requests are processed, paving the way for SQL injection and full site compromise. Immediate updates and temporary mitigations are essential to protect WordPress installations.