What happened (fast, with jokes)

WordPress just got a very rude wake-up call: a core bug combo nicknamed wp2shell can let a stranger on the internet run code on your site without logging in. Yes, anonymous. Yes, scary. The problem is two parts — a sloppy SQL handling and a separate routing mix-up — and when chained they let an attacker turn a harmless-looking HTTP request into full control.

The vulnerabilities landed fixes in recent releases (the SQL issue was patched back in the 6.8.x branch; the routing confusion and the full remote code execution chain were fixed in 6.9.5 and 7.0.2). If you see versions less than those on your site, upgrade now — like, yesterday.

Tech TL;DR (but not boring)

Short version: a SQL problem in WordPress core allows dangerous input to reach the database when a parameter expects an array but gets a string. That on its own is bad. The second bug is in the REST batch handler: it runs multiple requests in one call and can mix them up when one fails, which lets the attacker sneak their malicious payload into the vulnerable SQL spot without being authenticated.

  • The combo creates an unauthenticated RCE path on certain versions — meaning an anonymous request can execute code.
  • Version exposure splits like this: 6.8.0–6.8.5 had the SQL issue (fixed in 6.8.6); 6.9.0–6.9.4 and 7.0.0–7.0.1 were vulnerable to the full chain (fixed in 6.9.5 and 7.0.2 respectively).
  • If your site runs a persistent object cache (Redis or Memcached), this particular execution path may not work — but that’s a lucky side-effect, not a true fix. The SQL bug itself still matters.

Because the core is open source, the patch shows exactly what changed, and other researchers quickly reproduced the exploit after the fix was published. That means scanner signatures, exploit proofs, and automated attempts will appear fast. If you rely on default settings, assume you’re at higher risk.

What you should do right now

Immediate checklist (short, to the point):

  • Update WordPress to the latest patched version. If you run anything older than the patched releases mentioned above, update immediately.
  • Check whether auto-updates applied the patch. Don’t assume — verify the actual version in your dashboard or via the files on disk.
  • If you can’t update immediately, block anonymous callers from the REST batch endpoint as a temporary measure. This will likely break some integrations, so test first.

Temporary mitigation options (stopgaps):

  • At your WAF, block requests to the batch route and any equivalent REST route query strings. If you use a managed WAF, check its rules for this issue.
  • Disable unauthenticated REST access if your workflows allow it — that kills the vector but also breaks some plugins and integrations.
  • Add a tiny plugin or snippet that rejects anonymous calls to the batch handler early in request processing. This is a short-term bandage until you can update.

Final note: patches are out and public. Once a fix ships, the map to exploit it exists in the wild — so speed matters. Update first, then test integrations and monitor for suspicious traffic to the batch endpoints. Stay paranoid, caffeinated, and backed up.