WordPress Core users should be aware of CVE-2026-63030, a critical pre-authentication remote code execution flaw disclosed via a GitHub Security Advisory on July 17, 2026. Although GitHub's advisory labels the flaw as Critical, its current CVSS score sits at 7.5. Given how widely WordPress powers public-facing sites, a core-level vulnerability like this carries outsized risk for any organization running the platform.

Per research from Searchlight Cyber, the bug — nicknamed wp2shell — stems from the WordPress REST API's batch endpoint and can be triggered by an attacker with no account and no user interaction whatsoever, potentially handing them full control over the site and its data.

The advisory lists the affected releases as WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1, with patches shipped in 6.9.5 and 7.0.2, and the fix has also been backported into WordPress 7.1 Beta 2.

Cloudflare's own writeup notes that the exploitable code path opens up specifically on installations that aren't using a persistent object cache. Searchlight Cyber, credited with discovering the issue, added that no third-party plugins are needed — a stock WordPress install is exploitable out of the box.

Fixes

For any organization running an affected version of WordPress, upgrading without delay is the clearest path to resolving CVE-2026-63030. WordPress's own patched releases remain the recommended fix.

The table below breaks down which versions are exposed and where the fix lands: