WordPress Security Roundup — Core Unauthenticated RCE 'wp2shell' and a Wave of Admin Account Takeovers (July 2026)

In July 2026, the WordPress ecosystem that powers a large share of the web saw a run of security incidents rarely seen in recent memory. Most notably, a vulnerability allowing remote code execution (RCE) without any account was found in WordPress core itself, prompting an emergency patch, and a series of flaws that let attackers seize entire admin accounts were disclosed in popular plugins one after another. Here are the essentials.

1. wp2shell — Unauthenticated Remote Code Execution in WordPress Core

This is the heart of the incident. It is an attack chain combining two vulnerabilities, dubbed 'wp2shell', that lets an attacker with no account reach the site database and take full control. What makes it especially dangerous is that even a clean install with no plugins at all is affected.

• CVE-2026-63030 (Critical) — Confusion in the REST API batch route disables the permission check and, by way of SQL injection, leads to remote code execution. (Reported by: Adam Kues / Assetnote)
• CVE-2026-60137 (High) — A SQL injection that could originally only be triggered by logged-in users becomes reachable in an unauthenticated state when combined with the flaw above.

Affected versions and patches

The patches were released on July 17–18, 2026, and WordPress even triggered forced automatic updates, but real-world attacks were observed almost immediately after disclosure. Patchstack blocked more than 65,000 attack attempts from over 1,500 IP addresses, with web shell installations and backdoor admin account creation confirmed.

Response — Update immediately to 6.9.5 / 7.0.2 / 6.8.6 or later. If you cannot patch right away, a recommended temporary measure is to block the /wp-json/batch/v1 and ?rest_route=/batch/v1 paths at your WAF (this may affect some legitimate functionality).

2. A Wave of Plugin 'Admin Account Takeovers' — Password Reset Abuse

As it happened, several popular plugins were found to share the same type of critical flaw. Because their password recovery and reset features blindly trust an email address specified by the attacker, an unauthenticated attacker can intercept an admin account's reset link and hijack the account. All of the below carry a CVSS score of 9.8 (the highest tier).

• miniOrange OAuth SSO — CVE-2026-57807. Affects all versions up to and including 38.5.8; authentication bypass (password recovery abuse). Disclosed July 9.
• Kirki (Freeform Page Builder) — CVE-2026-8206. Affects 6.0.0–6.0.6, fixed in 6.0.7. About 150,000 sites were exposed, and active attacks are underway.
• Burst Statistics — CVE-2026-8181. Admin impersonation via authentication bypass. Disclosed May 8.

3. The WordPress Vulnerability Landscape in 2026

Beyond the individual incidents, the overall trend is worrying. Since the start of 2026, WordPress plugin vulnerabilities have been disclosed at a rate of more than 250 per week; 43% of them are exploitable without authentication, and 23% remain unpatched even 30 days after disclosure. It also stings that this core RCE has shattered the common belief that 'core is safe, so you only need to watch out for plugins.'

What to Do Right Now (Checklist)

• Update WordPress core to the latest security version immediately (6.9.5 / 7.0.2 / 6.8.6+)
• Audit every plugin in use — in particular, update immediately if you use miniOrange OAuth SSO, Kirki, or Burst Statistics
• Check your admin account list for any unfamiliar accounts that may have been added
• Scan your site files for unknown plugins, themes, or web shells
• Review your automatic updates, WAF, and regular backup setup

A Closing Note

VosCMS, the multilingual CMS built by THEVOS, continues to keep an eye on ecosystem issues like these, and we will steadily curate and share security news in the 'Security Advisory' category of this blog. Whatever platform you use, we encourage you to check your update status today.

Sources: Wordfence, Patchstack, Help Net Security, The Hacker News, BleepingComputer, Orca Security (July 2026).