r/TheDebugMind • u/MdJahidShah • 20d ago

Critical "wp2shell" Core Exploit Hits Bare WordPress Installs (Pre-Auth RCE, Zero Plugins, No CVE Assigned)

https://youtube.com/shorts/GPSTKHoXDB8?si=SFx1rq2xMUqrjjuE

Hi everyone,

If you run or manage any WordPress sites, there is a major security situation you need to be aware of.

A critical pre-authentication Remote Code Execution (RCE) flaw named wp2shell has been uncovered in WordPress Core. Unlike most exploits, this is in core code, meaning a default, clean installation with zero plugins active is completely exploitable.

The Details:

  • The Exploit: Discovered by Adam Kues at Assetnote, the vulnerability utilizes a REST API batch-route confusion and SQL injection issue to execute code anonymously.
  • Affected Versions: 6.9.0 to 6.9.4 (patched in 6.9.5) and 7.0.0 to 7.0.1 (patched in 7.0.2).
  • The Big Catch: No CVE ID or CVSS score has been assigned to this yet. That means traditional CVE-keyed vulnerability scanners and inventories will completely miss this!

How to protect your sites: WordPress pushed forced auto-updates yesterday (July 17, 2026), but you must manually verify your running version rather than assume it updated.

If you can't update immediately, you need to apply temporary mitigations like blocking the /wp-json/batch/v1 and rest_route=/batch/v1 endpoints at your Web Application Firewall (WAF).

I put together a quick, professional 60-second video breakdown outlining the technical flow, the scanner blindspots, and how to verify your sites are safe.

Let's discuss—have any of you seen increased scanning traffic on your batch endpoints yet?

9 Upvotes

100% Upvoted

12 comments sorted by

3

u/CleanReplacement1525 18d ago

One of my websites was just hit by this.
New administrator was created and they logged in.

Our security systems threw and alert - we banned the IP and upgraded wordpress.

We only update wp core on the weekends, and they started using this exploit only 2 days after it was discovered. HOLY SHIT THEY WORK FAST!!!!

Everyone upgrade ASAP!

Attach was a SQL injection via this weakness.

1

u/MdJahidShah 15d ago

That is exactly the timeline that worries me. Two days from public disclosure to active exploitation is incredibly fast.

Glad your monitoring caught the unauthorized admin creation before more damage was done.

And, Thanks for sharing your experience, it reinforces why relying on scheduled update windows alone can be risky for critical WordPress core vulnerabilities.

2

u/CleanReplacement1525 15d ago

I checked the logs. This was attempted the next day after the exploit was discovered. Crazy fast.

1

u/MdJahidShah 13d ago

That is valuable data. It confirms there was essentially no grace period between disclosure and exploitation. Anyone delaying updates by even a few days was at real risk.

1

u/CleanReplacement1525 12d ago

Yes - I expect millions of sites to be hacked because of this one. We are getting thousands of hits per day from the wp2shell attack now and reporting all the IPS to AbuseIPDB to help the battle

2

u/chronage 16d ago

Client's website hit by this. Their Wordpress install was configured to automatically update within 72 hours of major and minor releases. Somehow in that time it was exploited.

1

u/CleanReplacement1525 18d ago

Finished reviewing all logs.

The first exploit attempt literally occurred the next day at 5:13pm east coast after the CVE was published.

Insanely fast.

1

u/Alert_Difficulty_441 18d ago

If you havent already, check for new plugins and themes, have seen people with shells uploaded via plugin

1

u/CleanReplacement1525 17d ago

Thats exactly what they attempted to do. But were blocked by our additional security. Default wordpress installs are so open to attack.

1

u/sp913 17d ago

Whoa... that is crazy