Hackers are exploiting newly patched WordPress Core bugs (WP2Shell) for unauthenticated remote takeover, threatening millions of sites globally.
A massive cybersecurity emergency has struck the global web infrastructure, as threat actors begin aggressively weaponizing a pair of recently patched vulnerabilities in the world’s most popular content management system. Formally reported on Monday, July 20, 2026, the ongoing campaign targets a fundamental flaw in WordPress Core itself rather than third-party plugins or themes. Nicknamed “WP2Shell” by security researchers, this lethal vulnerability combination allows an unauthenticated, anonymous attacker to execute arbitrary code on a default, stock installation of WordPress with zero prior access or user interaction required. Because WordPress powers over 40% of all websites on the internet, the widespread availability of public proof-of-concept exploits has triggered an intense, automated race between malicious scanners and site administrators attempting to secure their endpoints.
The technical nature of this attack vector makes it so dangerous because it lies in the seamless chaining of two distinct security flaws within WordPress Core. The first bug, tracked as CVE-2026-60137, is a high-severity SQL injection flaw affecting database query validation. On its own, this SQL vulnerability requires an authenticated user account to execute. However, attackers pair it with CVE-2026-63030, a critical logic error inside the WordPress REST API Batch request handler. This second flaw creates a route-confusion condition where sub-requests inside a nested batch payload run under the wrong permission context. By tricking the server into executing a protected administrative command using the public privileges of a standard post query, an anonymous attacker bypasses authentication checks entirely, feeding malicious data into the SQL sink and establishing an active backdoor shell on the web server.
Defining this threat as actively unfolding reveals an immense global attack surface spanning millions of servers. Telemetry from international honeypots shows hundreds of thousands of indiscriminate exploit attempts originating from distributed IP addresses worldwide. The vulnerability affects all websites running WordPress versions 6.9.0 through 6.9.4 as well as versions 7.0.0 through 7.0.1. Security firms estimate that while automatic background updates have successfully patched a portion of the network, anywhere from 90 million to hundreds of millions of active websites globally remained exposed during the initial exploitation wave, impacting personal blogs, corporate enterprise portals, and government institutions alike.
The critical timeline of this vulnerability escalation highlights how dramatically the gap between patch release and active exploitation has closed. The WordPress Security Team officially pushed emergency security updates, releasing versions 6.8.6, 6.9.5, and 7.0.2, on Friday, July 17, 2026. However, within less than ten hours of the public code release over the weekend, security monitoring teams observed the first functional proof-of-concept scripts circulating on developer forums and dark web channels. By Sunday, July 19, and continuing into July 20, multiple threat groups had fully automated the exploit chain, launching mass-scanning bots to automatically inject backdoor administrator accounts across unpatched servers.
See Also: Somalia Launches National Cybersecurity Risk Management Framework to Guard Critical Infrastructure
The core reason this campaign broke out so rapidly points to the rising influence of artificial intelligence in vulnerability discovery and weaponization. Security analysts noted that reverse-engineering the official Friday patch to construct a working remote code execution script previously took days or weeks. In this instance, AI-assisted research tools enabled both defenders and attackers to analyze code diffs and build working exploit chains within hours. Furthermore, because the flaw exists in stock WordPress Core, attackers do not need to hunt for niche plugin configurations; a single payload works universally across any default site, offering bad actors an unprecedented return on investment.
About the Author
Jennifer Sakmufuwo Baba is a tech analyst and writer covering artificial intelligence, fintech, and emerging technologies at TechRegard. Based in Nigeria, she's passionate about translating complex tech developments into compelling, accessible stories for diverse audiences. Her work focuses on how technology shapes innovation across Africa and globally.
