If you run a WordPress site, this has been a rough month. On July 17, 2026, the WordPress security team quietly shipped version 7.0.2 to patch a two-bug chain now known across the industry as wp2shell — a pre-authentication remote code execution path that works against a stock WordPress install, no plugins required. Days earlier, agencies were still cleaning up after a critical UpdraftPlus flaw that let attackers forge admin-level commands without logging in. And Loco Translate, a plugin sitting on hundreds of thousands of sites, picked up its own critical CSRF-to-RCE fix in the same week.
Free Online wp2shell Test
None of these bugs care how nice your theme looks. They care about your version number.
Below is a breakdown of what’s actually going on with wp2shell and the other vulnerabilities currently worth losing sleep over, plus how to check — in about thirty seconds — whether your own site is exposed.
wp2shell: the one everyone’s talking about
wp2shell is the nickname Searchlight Cyber gave to a chain of two WordPress core vulnerabilities that, combined, let a completely anonymous attacker take over a default WordPress installation:
- CVE-2026-60137 — a SQL injection reachable through the
author__not_inparameter inside WordPress’s internalWP_Queryclass. On its own, this normally requires an authenticated session. - CVE-2026-63030 — a route-confusion bug in the REST API’s batch endpoint (
/wp-json/batch/v1). By itself it’s a logic flaw; chained with the SQLi above, it strips away the authentication requirement entirely.
Put together, an attacker with no account and no plugin dependency can reach the batch endpoint, exploit the route confusion to slip past the authentication check, and ride the SQL injection to dump credentials — from there it’s a short hop to a webshell. The chain works by having an anonymous attacker reach the vulnerable REST API batch endpoint, use the route confusion to slip a rogue parameter into WP_Query, and drive the SQL injection toward code execution.
Who’s exposed:
- WordPress 6.9 is affected by both vulnerabilities, with 6.9.5 released containing fixes for both
- WordPress 6.8 is only affected by the first vulnerability (the SQL injection), and 6.8.6 was released to fix it— so 6.8.x sites are still exposed to data-dumping SQLi even though the full RCE chain doesn’t reach them.
- Versions of WordPress prior to 6.8 are not affected by either issue.
- Even the WordPress 7.1 beta line needed a patch before its own release.
How serious is “serious”: The issue is pre-authentication, remotely reachable, affects WordPress core directly, doesn’t require any plugin, and now has public proof-of-concept code circulating, even though the original disclosure withheld technical details. WordPress powers an estimated 500 million websites worldwide, which is what makes a core-level, no-plugin-needed vulnerability like this one particularly dangerous.
This is exactly the kind of bug where “I’ll update it this weekend” is not a plan. If you’re anywhere in the 6.8.0–6.9.4 or 7.0.0–7.0.1 range, you’re carrying real risk right now.
The other bugs on the radar
wp2shell is getting the headlines, but it isn’t the only thing actively being exploited or freshly patched this cycle.
UpdraftPlus — CVE-2026-10795 (authentication bypass → RCE) UpdraftPlus is one of the most-installed backup plugins in the WordPress ecosystem, and this one is nasty precisely because it doesn’t need a password. The flaw lives in the plugin’s remote communications handling, where insufficient validation of message format allows signature verification to be bypassed, and unchecked decryption failures collapse to a predictable, all-zero encryption key. That lets an unauthenticated attacker forge remote procedure call commands that run as the connected administrator — including uploading and activating a malicious plugin, which leads straight to remote code execution. It affects everything up through 1.26.4; the fix landed in 1.26.5. Wordfence reported blocking nearly 5,000 attacks targeting this bug within a 24-hour window shortly after disclosure — this one isn’t theoretical.
Loco Translate — CVE-2026-15005 (CSRF → RCE) Loco Translate lets site admins edit translation files from the WordPress dashboard, which is exactly the kind of “trusted” workflow attackers love to abuse. The plugin is vulnerable to cross-site request forgery in all versions up to and including 2.8.5, due to missing or incorrect nonce validation on the execTemplate function, making it possible for an attacker to trick a logged-in user into a request that executes arbitrary PHP code on the server. Fixed in 2.8.6 — if you’re running an older build, a single malicious link clicked by a logged-in admin can be enough.
LiteSpeed Cache — CVE-2024-28000 An older but still commonly-found issue on LiteSpeed-hosted sites, affecting versions below 6.4. Still shows up in scans regularly because the plugin gets bundled with hosting packages and isn’t always kept current independently.
Database for Contact Form 7, WPForms, Elementor Forms — CVE-2025-7384 This connector plugin — used to pipe form submissions from several of the most popular WordPress form builders into a database table — is vulnerable below version 1.4.4. If you’re running any of those form plugins with this add-on, it’s worth a version check.
WordPress Core — CVE-2024-31210 (Plugin Upload RCE) An older core vulnerability affecting installs below 6.4.3. It requires admin authentication and specific configuration to trigger, so it’s lower-priority than wp2shell — but it’s a reminder that “core” bugs aren’t limited to this month’s headline chain, and version hygiene matters across the board.
Why “I’ll check later” isn’t good enough
A few things make this current wave different from routine plugin patch cycles:
- wp2shell needs no plugins at all. A completely stock WordPress install is exposed if the core version is wrong.
- UpdraftPlus’s bug needs no password. Authentication bypass means the attacker skips the part where they’d normally need to guess or steal credentials.
- Loco Translate’s bug only needs a click. CSRF attacks ride on an already-logged-in admin session — no direct access to your server required on the attacker’s end.
Different mechanisms, same outcome: full site compromise, often with no obvious warning sign until the malware, spam injection, or defacement shows up.
Check your site in under a minute
We built the WordPress Pentest Scanner specifically to catch this current wave of issues — including wp2shell — without requiring you to install anything or hand over admin credentials. Point it at your site’s URL and it runs through the following, in order:
Core detection
- WordPress version — identified via
/feed/,readme.html, the homepage meta tag, or?ver=query strings, or flagged as undetermined if your site is hardened against version fingerprinting. - wp2shell (CVE-2026-60137 / CVE-2026-63030) — flags the full unauthenticated SQLi-to-RCE chain on 6.9.0–6.9.4 and 7.0.0–7.0.1, and separately flags the SQLi-only exposure on the 6.8.0–6.8.5 branch.
- CVE-2024-31210 — checks for the core Plugin Upload RCE on versions below 6.4.3, noting that it requires admin auth and specific config to actually trigger.
- REST API batch route reachability (
/wp-json/batch/v1) — a supplementary signal for the wp2shell check, testing whether the endpoint even responds.
Plugin detection (read directly from each plugin’s public readme.txt) 5. LiteSpeed Cache — flags CVE-2024-28000 below version 6.4. 6. Database for Contact Form 7 / WPForms / Elementor Forms — flags CVE-2025-7384 below version 1.4.4. 7. UpdraftPlus — flags CVE-2026-10795 below version 1.26.5. 8. Loco Translate — flags CVE-2026-15005 below version 2.8.6.
The scan is read-only and non-intrusive — it looks at what’s publicly exposed about your install the same way an attacker’s reconnaissance would, and tells you what they’d see.
If it flags something, the fix in almost every case above is the same: update to the patched version. That’s it. But you have to know first — and given how quickly wp2shell went from disclosure to public proof-of-concept, “I’ll get to it” is a bet you don’t want to lose.
This article reflects publicly disclosed vulnerability data as of July 19, 2026. WordPress core and plugin security landscapes change quickly — check back or re-scan periodically, especially if you manage multiple installs.
