Critical wp2shell RCE Flaw Hits Millions of WordPress Sites, Emergency Patch Released

A critical security vulnerability has been discovered in the core of WordPress, the content management system that powers a significant portion of the web. Dubbed 'wp2shell' and assigned CVE-2026-63030, the flaw allows unauthenticated remote code execution (RCE) through a SQL injection vector.

Security researchers warn that the vulnerability affects millions of WordPress sites globally. The WordPress development team has responded by releasing an emergency patch.

What the wp2shell Vulnerability Does

At its core, the wp2shell vulnerability lets an attacker with no prior access to a WordPress site execute arbitrary code on the server. This is achieved through a SQL injection attack that bypasses authentication checks.

Once exploited, the attacker can take full control of the website. They can steal data, deface pages, install malware, or use the compromised server for further attacks. The severity rating is critical, and multiple security organisations have confirmed the details.

Security Firms Confirm the Threat

Several major cybersecurity companies have issued advisories. Cloudflare noted that its Web Application Firewall (WAF) can protect WordPress applications from this vulnerability. The company urged users to ensure their WAF rules are up to date.

Aikido Security described it as an unauthenticated RCE vulnerability in WordPress core, explicitly naming the 'wp2shell' mechanism. The Hacker News reported that the flaw lets unauthenticated attackers run code remotely. Rapid7, a well-known security firm, assigned the CVE number and confirmed it is a critical remote code execution vulnerability.

Who Is Affected

The vulnerability exists in core WordPress files, meaning it is not limited to a specific plugin or theme. Any WordPress site running a version prior to the patch is at risk. Estimates suggest millions of installations could be vulnerable.

Sites that have not yet applied the latest security update are the most exposed. Attackers are already actively scanning for vulnerable targets, security researchers have warned.

What Site Owners Must Do Now

The immediate action for all WordPress site administrators is to update their installations to the latest patched version. The emergency release from the WordPress team includes the fix for CVE-2026-63030.

Users should also consider additional security layers. Deploying a Web Application Firewall, like Cloudflare's, can block exploit attempts even before a patch is applied. Regular security audits and monitoring for unusual activity are also recommended.

Those using managed WordPress hosting should check if their provider has already applied the update automatically. If not, manual updating is essential.

What to Watch For Next

Security experts expect exploit code to be publicly released within days, if it has not been already. This will lower the barrier for less skilled attackers to launch large-scale attacks.

WordPress users should also watch for further advisories from the WordPress security team and their hosting providers. The focus now is on patching speed and ensuring other security measures are in place before the next wave of attacks begins.