Hackers Are Actively Exploiting Two Patched WordPress Flaws - Up to 90 Million Sites at Risk

Hackers are actively exploiting two critical WordPress vulnerabilities patched last week, taking over websites that have not yet updated to the fixed versions. Update now. Researchers at Patchstack, Hexastrike, and WatchTowr confirmed active exploitation as of Monday - three days after WordPress released emergency patches on July 17 with forced auto-updates enabled. The more dangerous of the two, dubbed WP2Shell by Adam Kues of Searchlight Cyber, is a pre-authentication WordPress vulnerability in the REST API batch endpoint that lets any anonymous user take full remote control of a site with zero plugins and zero prior access required.

WP2Shell: Pre-Auth RCE on the /wp-json/batch/v1 Endpoint

WP2Shell (CVE-2026-63030) is a REST API batch-route confusion and SQL injection chain. No plugin installed on the victim site. An attacker sends a crafted unauthenticated request to /wp-json/batch/v1 and gets remote code execution on the server - on a stock WordPress install, no configuration required on either end. Searchlight Cyber has not released full technical details to give defenders time to patch, but published a free WordPress vulnerability checker at wp2shell.com plus three interim mitigations: install the "Disable WP REST API" plugin, add a WAF rule blocking /wp-json/batch/v1, or drop a short custom plugin that restricts unauthenticated access to the batch endpoint. None of those are permanent fixes - only updating is.

The Second Bug Is a SQL Injection - WordPress 6.8 Users Are Also Affected

CVE-2026-60137, a SQL injection issue reported separately by researchers TF1T, dtro, and haongo, is the second flaw. Chaining both together gives an attacker full site takeover - WP2Shell handles the code execution; the SQL injection adds a separate path for data access. WordPress 6.8 users need to patch too: that branch is affected by the SQL injection bug but not by WP2Shell, and WordPress 6.8.6 is the fix. Versions of WordPress prior to 6.8 are not affected by either CVE.

~90 Million Sites Still Exposed - Forced Auto-Updates Are Helping, But Not Fast Enough

WordPress pushed forced auto-updates for affected sites last Thursday, which is why the exposure figure is lower than the raw numbers suggest. WordPress's own version statistics show more than 400 million websites running the vulnerable versions - 6.9.0 through 7.0.1 - but security researcher Daniel Card sampled ~4,200 WordPress sites and found fewer than 15% were still unpatched as of Monday. Roughly 90 million sites remain exposed. Cloudflare is also blocking exploit attempts against unpatched sites, providing additional cover for the sites auto-update has not yet reached - and alongside this week's Hugging Face security incident, it is a reminder that attackers are not waiting for patch cycles to catch up.

WordPress 7.0.2 and 6.9.5 are the required updates. Searchlight Cyber's interim mitigations - WAF rules blocking /wp-json/batch/v1 or the REST API restriction plugin - cover the WP2Shell vector specifically but do not address the SQL injection bug. Both CVEs require a full patch. Patchstack, Hexastrike, and WatchTowr confirmed active exploitation from live sensor data, not proof-of-concept testing, and the window between patch release and broad deployment is exactly where attackers consistently concentrate their efforts. WordPress powers about 43% of all websites on the internet - the potential blast radius of an unpatched pre-authentication RCE in core does not get much larger than this.