A WordPress vulnerability known as 'wp2shell' has been exploited in actual cases, prompting an official warning to update to the patched version as soon as possible.
On July 17, 2026, WordPress version 7.0.2 was released, which fixes a vulnerability that allowed for remote code execution without authentication. Because there have been instances of this vulnerability being exploited, a prompt update is strongly recommended.
WordPress 7.0.2 Release – WordPress News
Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25 › Searchlight Cyber
AI helped uncover WordPress 'wp2shell' RCE now exploited in attacks | CyberInsider
https://cyberinsider.com/ai-helped-uncover-wordpress-wp2shell-rce-now-exploited-in-attacks/
The attack chain 'wp2shell' was discovered by Adam Kuse of cybersecurity firm Searchlight Cyber using OpenAI's AI model 'GPT-5.6 Sol Ultra'.
An attacker exploiting this vulnerability could temporarily impersonate an administrator, re-execute the original REST request with administrator privileges, create a new administrator account, upload a malicious plugin, and execute the code.
wp2shell combines two vulnerabilities. The first is CVE-2026-63030, which allows a malicious request to cause WordPress to validate a subrequest against the wrong handler and execute it using a different handler, bypassing WordPress's validation function due to the confusion between batch and route processing. The second is CVE-2026-60137, which enables SQL injection due to improper sanitization.
According to Mr. Cues, the vulnerability could be exploited through WordPress's default settings, and GPT-5.6 Sol Ultra was able to identify the vulnerability and even develop an attack method. Mr. Cues reported, 'GPT-5.6 Sol Ultra spent four hours writing an attack chain from SQL injection to remote code execution, but it took me much longer to understand it.' Mr. Cues soon shared the issue with the WordPress team.
WordPress.org has enabled a forced update via its automatic update system for sites using affected versions, forcing them to update to the corrected version.
According to the security firm Patchstack , they have observed instances where attackers have exploited wp2shell.
Related Posts:
in Security, Posted by log1p_kr