WordPress 7.0.2 Patches Critical Unauthenticated RCE Chain

WordPress 7.0.2 fixes two core vulnerabilities (CVE-2026-60137 and CVE-2026-63030) that allow unauthenticated remote code execution. Exploitation attempts and a public PoC are already circulating. Update immediately if you're on 6.8 through 7.0.1.

4 min readJul 21, 2026

WordPress 7.0.2 Patches Critical Unauthenticated RCE Chain

Patch Now: WordPress 7.0.2 Fixes Unauthenticated RCE Chain

On July 17, 2026, WordPress released version 7.0.2 to patch two chained vulnerabilities that allow unauthenticated remote code execution on any affected installation. The update also backports fixes to 6.9.5 and 6.8.6. If you're running WordPress 6.8, 6.9, or 7.0 and haven't updated, your site is exploitable by anyone on the internet.

Security firm PatchStack reported exploitation attempts within hours of disclosure. A working proof-of-concept exploit is now public. Treat this as an active attack.

The Vulnerabilities: CVE-2026-60137 and CVE-2026-63030

The chain, dubbed "WP2Shell" by researchers, combines an SQL injection in WP_Query with a REST API batch route confusion to achieve full RCE.

CVE-2026-60137: SQL Injection in WP_Query

Severity: High
Affected: WordPress 6.8 through 7.0.1
Fixed in: 6.8.6, 6.9.5, 7.0.2

The author__not_in parameter in WP_Query lacks proper escaping, allowing unauthenticated SQL injection. Attackers can read arbitrary database records (user credentials, post content, configuration) and modify or delete data. Alone, this is a serious information-disclosure bug. Chained with the next vulnerability, it becomes a stepping stone to full compromise.

CVE-2026-63030: REST API Batch Route Confusion → RCE

Severity: Critical
Affected: WordPress 6.9.0 through 6.9.4, 7.0.0 through 7.0.1
Fixed in: 6.9.5, 7.0.2
CVSS: 7.5 (official), 9.8 (Wordfence full chain)
Discoverer: Adam Kues at Assetnote / Searchlight Cyber

This vulnerability resides in the /wp-json/batch/v1 endpoint. An unauthenticated attacker can confuse the routing mechanism and chain it with the SQL injection to execute arbitrary PHP code. No plugins, themes, or special configuration required.

Impact: From HTTP Request to Full Server Control

Neither vulnerability alone is as dangerous as the chain. The SQL injection gives database access. The batch route confusion gives code execution. Together, they provide a complete compromise path from a single unauthenticated HTTP request to full server control.

Affected Versions

Version	CVE-2026-60137 (SQLi)	CVE-2026-63030 (RCE)	Fix Version
6.8.x (prior to 6.8.6)	✅	❌	6.8.6
6.9.0 – 6.9.4	✅	✅	6.9.5
7.0.0 – 7.0.1	✅	✅	7.0.2
7.1 beta	✅	✅	7.1 Beta 2
Prior to 6.8	❌	❌	N/A

What to Do Right Now

Step 1: Check Your Version

Via admin: Dashboard → Updates.

Via SSH:

grep &#39;\$wp_version =&#39; wp-includes/version.php

Step 2: Update Immediately

WordPress 7.0.x → 7.0.2: Dashboard → Updates, click "Update Now"
WordPress 6.9.x → 6.9.5: same
WordPress 6.8.x → 6.8.6: same

Via WP-CLI:

wp core update
wp core update-db

Via SSH (backup first):

wp db export backup-$(date +%Y%m%d).sql
wp core update
wp core update-db

Step 3: Verify

Check version again; you should see 6.8.6, 6.9.5, or 7.0.2.

Step 4: If You Can't Update Immediately

Block the batch API at your WAF:

Block /wp-json/batch/v1
Block ?rest_route=/batch/v1

Or install a plugin that blocks anonymous REST API access. These are temporary measures — update as soon as possible. Cloudflare released an emergency WAF rule on July 17; verify it's active under Security → WAF → Managed Rules.

Check for Compromise

New admin accounts:
```
wp user list --role=administrator
```

Suspicious PHP files:

find /path/to/wordpress -name &#34;*.php&#34; -mtime -7 -type f

Database injections:

wp db query &#34;SELECT user_login, user_email, user_registered FROM wp_users WHERE user_registered &gt; &#39;2026-07-01&#39;&#34;

Access logs: Look for unusual POST requests to /wp-json/batch/v1 from July 17 onward.
Scan with Wordfence: Premium users got firewall protection on July 17; free users will get it around August 16.

Why This Is Different

Most WordPress vulnerabilities affect plugins or themes. This one is in core. Every default installation is a potential target. No authentication required. Exploit code is public. This is one of the most significant WordPress security events in recent years.

Bottom Line

Update now. Check your version, patch manually, and verify. This isn't a "wait and see" situation. It's a "patch tonight" situation.

Editor's Take

I've seen a lot of WordPress security advisories over the years, but this one genuinely scared me. The fact that it's a core vulnerability chain with unauthenticated RCE and public exploit code is a perfect storm. I've already patched all my sites and checked for compromise. If you haven't done the same, stop reading and go update. I've been recommending Cloudflare's WAF for years, and this incident proves why — their emergency rule was a lifesaver. Still, a WAF is a band-aid; the real fix is updating.

— DevDigest Editorial

Key Takeaways

•Update WordPress immediately to 7.0.2, 6.9.5, or 6.8.6 depending on your branch.
•Block /wp-json/batch/v1 at your WAF as a temporary mitigation if you cannot patch immediately.
•Run the provided commands to check for signs of compromise, especially new admin accounts and suspicious files.

Why It Matters

This is a core WordPress vulnerability chain allowing unauthenticated RCE. Exploit code is already public. If you manage any WordPress site on 6.8 through 7.0.1, you need to patch immediately to prevent complete site takeover.

#security#wordpress#rce#patch#sql-injection

Get the weekly digest

Every Sunday - top tech stories, industry breakthroughs, and developer tools delivered to your inbox.

No spam, unsubscribe anytime.