Critical WordPress Core Vulnerability (wp2shell): Update Now, But Back Up First

Introduction

A critical, unauthenticated remote code execution vulnerability — nicknamed wp2shell — is actively being exploited across WordPress sites right now. Tracked as CVE-2026-63030 and CVE-2026-60137, it chains two flaws in WordPress core’s REST API batch endpoint to let an anonymous attacker run code on a completely stock WordPress install — no plugins, no login, no user interaction required.

The flaw affects WordPress core versions 6.9.0–6.9.4 and 7.0.0–7.0.1. It was added to CISA’s Known Exploited Vulnerabilities catalog on July 21, and security researchers at VulnCheck have already logged more than two dozen distinct public proof-of-concept exploits. If your site is on an affected version, this is not a “patch when convenient” situation — it’s being used to install webshells today.

What You Should Do Right Now

1. Check your WordPress version. Go to Dashboard → Updates or look at the version number in your admin footer.
2. Take a full backup before updating. This sounds backwards when the whole point is urgency, but a core update on a site that’s already been probed or partially compromised can turn a bad situation into an unrecoverable one. A fresh backup means that whatever happens next — a bad update, a plugin conflict, or discovering the site was already breached — you have a clean point to restore to.
3. Update WordPress core immediately to the patched release.
4. Check for signs of compromise if your site was running an affected version for more than a few days — unfamiliar admin users, unknown files in wp-content, or unexpected scheduled tasks are red flags. See our guide on recovering a hacked WordPress site if you find anything suspicious.

Why Backing Up First Actually Matters Here

With a pre-auth RCE chain like this, exploitation doesn’t always look dramatic. Attackers using automated tools can plant a small webshell and leave the rest of the site looking completely normal, which means the update you’re about to run could be happening on a site that’s already been touched. Having a backup from right before the update gives you a known-clean (or at least known-state) snapshot to compare against or restore from, instead of trying to untangle “was this broken by the update or was it already broken” after the fact.

This is also exactly the kind of situation where an off-site backup you can restore without wp-admin access matters most — if an update goes wrong or the dashboard becomes inaccessible, you don’t want your only backup sitting on the same compromised server.

FAQ

Is my site affected if it’s fully managed by a host like WP Engine or Kinsta?
Most managed hosts push emergency core updates automatically for critical CVEs like this one, but it’s worth confirming your version in wp-admin rather than assuming. Self-hosted and VPS sites need to update manually.

Do I need any specific plugin installed to be at risk?
No — that’s what makes wp2shell unusually dangerous. It targets WordPress core’s REST API directly and doesn’t require any third-party plugin to be present.

How do I know which WordPress version I’m running?
Log into wp-admin and check Dashboard → Updates, or scroll to the bottom of any admin screen where the version number is usually displayed.

What if I can’t update right away?
Some hosts and security plugins can apply virtual patches or WAF rules for specific CVEs as a stopgap, but this should only ever be temporary — the real fix is updating core.

Conclusion

wp2shell is a reminder that core, not just plugins, can be the entry point for a full site compromise — and that patching fast only helps if you’re not also risking your only copy of the site in the process. Back up, update, verify, repeat.