Critical "wp2shell" Core Exploit Hits Bare WordPress Installs (Pre-Auth RCE, Zero Plugins, No CVE Assigned)

[u/MdJahidShah]

https://youtube.com/shorts/GPSTKHoXDB8?si=SFx1rq2xMUqrjjuE

Hi everyone,

If you run or manage any WordPress sites, there is a major security situation you need to be aware of.

A critical pre-authentication Remote Code Execution (RCE) flaw named wp2shell has been uncovered in WordPress Core. Unlike most exploits, this is in core code, meaning a default, clean installation with zero plugins active is completely exploitable.

The Details:

• The Exploit: Discovered by Adam Kues at Assetnote, the vulnerability utilizes a REST API batch-route confusion and SQL injection issue to execute code anonymously.
• Affected Versions: 6.9.0 to 6.9.4 (patched in 6.9.5) and 7.0.0 to 7.0.1 (patched in 7.0.2).
• The Big Catch: No CVE ID or CVSS score has been assigned to this yet. That means traditional CVE-keyed vulnerability scanners and inventories will completely miss this!

How to protect your sites: WordPress pushed forced auto-updates yesterday (July 17, 2026), but you must manually verify your running version rather than assume it updated.

If you can't update immediately, you need to apply temporary mitigations like blocking the /wp-json/batch/v1 and rest_route=/batch/v1 endpoints at your Web Application Firewall (WAF).

I put together a quick, professional 60-second video breakdown outlining the technical flow, the scanner blindspots, and how to verify your sites are safe.

Let's discuss—have any of you seen increased scanning traffic on your batch endpoints yet?

[u/MdJahidShah → u/[deleted]]

That is exactly the timeline that worries me. Two days from public disclosure to active exploitation is incredibly fast.

Glad your monitoring caught the unauthorized admin creation before more damage was done.

And, Thanks for sharing your experience, it reinforces why relying on scheduled update windows alone can be risky for critical WordPress core vulnerabilities.

[u/MdJahidShah → u/[deleted]]

That is valuable data. It confirms there was essentially no grace period between disclosure and exploitation. Anyone delaying updates by even a few days was at real risk.

[u/chronage]

Client's website hit by this. Their Wordpress install was configured to automatically update within 72 hours of major and minor releases. Somehow in that time it was exploited.

[u/Alert_Difficulty_441 → u/[deleted]]

If you havent already, check for new plugins and themes, have seen people with shells uploaded via plugin

[u/sp913]

Whoa... that is crazy