wp2shell: WordPress Core Pre-Auth RCE Fixed in 6.9.5 and 7.0.2

wp2shell is a pre-authentication remote code execution flaw in WordPress core. An anonymous HTTP request can trigger it against a default install with no plugins. WordPress released 6.9.5 and 7.0.2 on July 17, 2026 to close it, and turned on forced updates through its auto-update system to push the patch to affected sites.

Adam Kues at Assetnote, the attack surface management arm of Searchlight Cyber, found the bug and reported it through WordPress's HackerOne program. The firm's writeup, published under the name wp2shell, states the attack has "no preconditions and can be exploited by an anonymous user." Assetnote is holding back the technical details for now. Instead it posted a checker at wp2shell.com so owners can test their own instance.

WordPress describes Kues's finding as "a REST API batch-route confusion and SQL injection issue leading to Remote Code Execution." The release closes one critical and one high severity flaw, and the project has not said which is which.

Two release ranges are in scope. The vulnerable code only exists from 6.9 onward, which shipped on December 2, 2025, so every affected site is running a release less than eight months old.

• 6.9.0 through 6.9.4, fixed in 6.9.5
• 7.0.0 through 7.0.1, fixed in 7.0.2
• 7.1 beta2 carries the same fix

Sites still on 6.8 have an update waiting too, but 6.8.6 addresses a separate SQL injection bug reported by a different team in the same round. Searchlight's post cites the common estimate that over 500 million websites run WordPress. That is the total install base, not the vulnerable population. Neither advisory says how many sites the affected ranges cover.

The version page lists three files that 7.0.2 touched, covering both fixes in the round: /wp-includes/rest-api/class-wp-rest-server.php, /wp-includes/class-wp-query.php, and /wp-includes/rest-api.php.

The batch endpoint itself isn't new. WordPress has shipped it since 5.6 in November 2020 and documented the request format publicly ever since. Nothing published so far explains what changed in 6.9 to open the flaw. The two accessible routes are /wp-json/batch/v1 and rest_route=/batch/v1, and both matter for mitigation.

Updating to 6.9.5 or 7.0.2 is the fix. If you can't update immediately, every mitigation Searchlight offers comes down to keeping anonymous callers off the batch endpoint. All three are stopgaps, and all can break legitimate integrations.

• At a WAF, block both /wp-json/batch/v1 and rest_route=/batch/v1. The firm is explicit that both must go; a rule covering only the /wp-json path leaves the query-string route open.
• Disable the WP REST API, which kills unauthenticated REST access wholesale.
• Deploy a short drop-in plugin that hooks rest_pre_dispatch and rejects anonymous /batch/v1 requests.

Neither advisory carries a CVE ID or a CVSS score, and no CVE record had appeared by July 18. That has practical consequences. CVE-keyed scanners and inventories won't flag this one, and CISA needs a CVE before it can add anything to its Known Exploited Vulnerabilities catalog.

No exploitation attempt had been reported as of July 18. With no CVE and no public signature, detection depends on watching traffic against the batch/v1 routes and on WordPress's own version statistics.

Mass exploitation of WordPress is now an industry. Before its server leaked in June, the WP-SHELLSTORM crew got into more than 17,000 sites by its own count via a single caching-plugin flaw. That bug was already public, already patched, and only worked on a non-default setting.

When Drupal patched an anonymous SQL injection in its own core in May, Searchlight turned that public fix into a same-day teardown with two working proofs of concept. WordPress core is open source, and 7.0.1 and 7.0.2 both sit in the public release archive, so the diff is available to anyone who wants it. That's the bind for open-source projects: you can't ship the fix without shipping a map to the bug. The only lever left is how fast the patch reaches sites before someone reads it.

Two numbers will tell the story. Traffic against the batch/v1 routes shows when attackers arrive, and WordPress's version statistics show whether the forced update got there first. Watch for a CVE assignment, any public proof of concept, and Assetnote releasing the withheld technical writeup.

A default WordPress install on an affected version can be compromised by an unauthenticated attacker sending a single crafted request to the REST batch endpoint.

Security: Pre-auth RCE against a default install means no plugin, credential or configuration barrier stands between an anonymous request and execution.

Privacy: Site and user data stored in the WordPress database could be exposed following compromise.

WordPress patched a pre-auth core RCE named wp2shell in 6.9.5 and 7.0.2 on July 17, 2026, affecting 6.9.0-6.9.4 and 7.0.0-7.0.1.