A recently disclosed security vulnerability known as WP2Shell is putting WordPress sites at risk by allowing attackers to create administrator accounts and install web shells without needing to log in. This exploit leverages two specific flaws in the WordPress Core, identified as CVE-2026-63030 and CVE-2026-60137. The first flaw affects the REST API batch controller, which can mismanage nested requests, while the second is an SQL injection vulnerability in the posts endpoint. Together, these vulnerabilities enable attackers to execute server-side code, establishing a foothold on the compromised system.

According to an analysis by Seqrite, the WP2Shell attack does not seem to be widely exploited in the wild as of their October 16 report. However, the potential danger lies in its ability to bypass login authentication entirely, exposing sites that run affected WordPress versions. The vulnerability chain allows an attacker to create unauthorized administrator accounts, manipulate plugin directories, and potentially execute arbitrary server commands.

Seqrite's technical breakdown highlights that the REST API flaw allows unauthenticated requests to access sensitive routes, which then interact with the SQL injection vulnerability to affect database queries unexpectedly. This results in an attacker gaining administrative access and potentially performing remote code execution. The researchers noted the presence of specific artifacts, such as unexpected PHP files and new administrator accounts, as indicators of compromise.

The affected WordPress versions include 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, with earlier versions being vulnerable to the SQL injection flaw alone. Patching to versions 6.8.6, 6.9.5, or 7.0.2 is recommended to mitigate these issues. Additionally, administrators should audit their sites for any unfamiliar accounts, unexplained changes in plugin folders, and suspicious log entries to ensure their systems remain secure.