Searchlight Cyber discovered wp2shell a critical pre authentication remote code execution zero day in WordPress Core versions 6.9.0 through 7.0.1 exploitable by anonymous users through the batch REST API with no plugins required on over 500 million websites worldwide.

Imagine an anonymous stranger sitting anywhere on the internet opening a browser tab typing a single crafted request against any standard WordPress installation and watching a shell open on that server within seconds. No username needed. No password attempt. No plugin vulnerability to chain.

Just WordPress core doing exactly what it was designed to do while that request slips through a gap that nobody caught before July 17 2026. That day Searchlight Cyber security researcher Adam Kues published a two paragraph advisory that sent the entire WordPress ecosystem into emergency patching mode and the name they gave this flaw was wp2shell.

WP2Shell WordPress Zero Day Technical Explanation

WordPress powers somewhere above 500 million websites worldwide making it the single largest deployment surface of any web software in existence. Every major vulnerability affecting WordPress core therefore carries a potential blast radius that dwarfs almost any other software disclosure.

The wp2shell finding represents the worst possible category within that already consequential landscape. Pre authentication remote code execution with no plugins required on a stock install means the only condition an attacker needs to meet involves finding a WordPress instance running the affected version range and pointing a request at it.

Searchlight Cyber confirmed the vulnerable version range as WordPress 6.9.0 through 7.0.1. The 6.8.x branch and all releases before 6.9.0 do not carry the flaw. Both the 6.9 series and the 7.0 series introduced whatever underlying code path the researchers exploited and both required separate patches to close it. The fixed versions are WordPress 7.0.2 for anyone on the 7.0 branch and WordPress 6.9.5 for anyone remaining on the 6.9 branch.

Searchlight deliberately withheld technical details at the time of publication to give defenders time to patch before weaponized exploit code appeared in the wild. That decision follows the same coordinated approach that responsible disclosure practices recommend specifically for vulnerabilities with this severity profile where a public technical writeup would hand a working attack primitive to every threat actor simultaneously. The team coordinated with the WordPress security team ahead of publication to ensure patches were already available before any advisory appeared publicly.

What the advisory does confirm involves the attack surface. The temporary mitigation path Searchlight recommended points directly at the WordPress REST API batch endpoint accessible at the path wp-json/batch/v1 and the equivalent query string form using rest route equals batch/v1.

The recommendation to block anonymous access to specifically this endpoint rather than to the REST API more broadly indicates the vulnerability lives somewhere within the batch processing logic rather than across the entire REST API surface.

The batch endpoint was introduced to allow clients to send multiple REST API requests bundled together in a single HTTP call reducing round trips for complex operations. That optimization design apparently introduced a code path that could be reached without authentication and then leveraged to achieve remote code execution.

The severity designation of pre authentication remote code execution on WordPress core with no additional requirements represents the highest possible risk classification for a web application vulnerability.

Traditional WordPress security thinking focused heavily on plugin vulnerabilities because WordPress core itself maintained a strong security track record over many years. A core vulnerability of this class breaks that established mental model and forces administrators to treat even otherwise locked down WordPress installations as fully exposed until patching completes.

The scale of exposure defies easy comparison to most other vulnerabilities. When a plugin affects a million sites the community treats that as major news. When WordPress core carries a pre auth RCE the affected count crosses half a billion.

Automated exploitation infrastructure does not need a long window of opportunity at that scale. Mass scanning for vulnerable version strings combined with a working exploit could compromise millions of sites within hours of a public technical writeup appearing anywhere online.

Batch API Attack Vector Exposure Scope And Mitigation Guide

The disclosure of wp2shell followed Searchlight Cyber’s pattern of using vulnerability discovery to validate their attack surface management platform Assetnote. The team notes that Assetnote customers received detection checks for this vulnerability often weeks or months before public disclosure through their standard research pipeline.

That head start represents meaningful practical value in vulnerability management since the organizations most exposed to new critical vulnerabilities typically lack the internal research capacity to discover and assess them faster than the broader security community.

Understanding what the batch REST API endpoint actually does helps frame why it became the attack surface here. WordPress introduced batch processing in recent releases to let themes plugins and the block editor send multiple simultaneous requests such as saving multiple blocks checking multiple post statuses or running multiple queries in parallel through a single authenticated session.

The endpoint routes those bundled requests through the same permission checking system that protects individual REST API routes. Somewhere in that routing and permission checking flow the wp2shell vulnerability opens a path that bypasses authentication entirely and reaches code execution rather than simply returning data.

Website owners running the affected version range should treat patching as an emergency priority rather than a routine maintenance task. The automatic update system built into modern WordPress installations should already be pushing version 7.0.2 or 6.9.5 to sites that have enabled automatic core updates.

Site administrators who disabled automatic updates or who run managed hosting environments where updates require manual approval should verify the installed version immediately and initiate the upgrade regardless of other planned maintenance windows.

For anyone genuinely unable to apply the patch immediately the two emergency mitigation paths Searchlight recommended both carry operational tradeoffs worth understanding before implementing.

Installing a plugin that blocks anonymous REST API access entirely will protect against wp2shell exploitation since the attack requires unauthenticated access to the batch endpoint but this approach also breaks any functionality that legitimately depends on unauthenticated REST access including some headless WordPress deployments progressive web apps and certain publicly facing content APIs.

Blocking just the batch endpoint path at a WAF or reverse proxy level provides more surgical protection and leaves other unauthenticated REST routes functional but requires WAF access and correct rule configuration which not every hosting environment provides easily.

Hosting providers running large scale shared WordPress environments face a different operational challenge. A single hosting platform may carry thousands of individual WordPress installations across shared infrastructure and ensuring every tenant upgrades promptly requires either automated update enforcement centralized version management or direct communication with each account holder. Providers who push core security updates automatically across their fleet can close this exposure window far faster than environments where each site administrator must act individually.

Detection of active exploitation attempts before a full technical writeup becomes public relies on anomalous patterns in web server logs rather than on known attack signatures. Any unusual volume of requests hitting the batch REST endpoint from diverse source addresses warrants immediate investigation.

Responses from that endpoint delivering unexpected HTTP status codes payload sizes or execution times during the current vulnerability window should also trigger review since successful exploitation almost certainly produces observable anomalies in server behavior even before any specific signature becomes available.The researchers also released a free public scanner at wp2shell[.]com

The broader lesson of wp2shell sits in what it reveals about the limits of plugin focused WordPress security strategy. Years of accurate messaging about plugin vulnerabilities as the primary risk helped many administrators build reasonable plugin management practices while treating core as essentially trusted infrastructure.

A pre authentication RCE in core with no plugin dependency required serves as a direct challenge to that framework and a reminder that the attack surface underneath any application includes every line of code in its foundation including the lines added most recently in the name of modern feature development.

WordPress core receiving a pre auth RCE of this severity while running more than half the active websites on the public internet makes the July 17 disclosure one of the most consequential single vulnerability reports of 2026 regardless of how quickly patching reaches the full installed base.

The gap between patch availability and full deployment across five hundred million sites will remain wide for weeks and that gap continues to represent real exposure for every unpatched installation sitting reachable on the public internet right now.