New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

A critical Remote Code Execution (RCE) vulnerability has been discovered in WordPress core, impacting versions 6.9 through 6.9.4 and 7.0 through 7.0.1. The flaw, identified by Searchlight Cyber's team and reported through WordPress's HackerOne program, allows unauthenticated attackers to run code on a WordPress site by exploiting a batch request endpoint. The vulnerability is described as a REST API batch-route confusion and SQL injection issue. WordPress released 7.0.2 and 6.9.5 on July 17, 2026 to address the issue.

Searchlight Cyber estimates that over 500 million websites run WordPress, but only those using versions less than eight months old are affected. WordPress has not yet assigned a CVE ID or a CVSS score to the vulnerability.

To mitigate the risk, WordPress recommends blocking the `/wp-json/batch/v1` and `rest_route=/batch/v1` endpoints at a Web Application Firewall (WAF) or disabling the WP REST API entirely. These are temporary solutions until updates are applied.

WordPress core is open source, meaning the fix is readily available for anyone to use. However, the speed at which the patch reaches sites before attackers can exploit it is a key factor. The vulnerability follows a pattern of widespread WordPress exploitation, as demonstrated by the WP-SHELLSTORM crew exploiting a caching plugin flaw in May, which led to over 17,000 sites being compromised. The firm’s rapid response to that vulnerability – publishing a proof of concept within a day – highlights the urgency in addressing these types of issues.