Searchlight Cyber disclosed on July 17, 2026 a pre-authentication remote code execution chain in WordPress core, nicknamed wp2shell, that requires no plugins and no prior access: an anonymous visitor to a stock WordPress 6.9.0-6.9.4 or 7.0.0-7.0.1 install can reach full code execution. The flaw affects WordPress core itself rather than a theme or plugin, which is what makes it unusual: it sits in software running on a large share of the web’s back-end sites.
Researcher Adam Kues at Assetnote, Searchlight Cyber’s attack surface management arm, found the underlying REST API batch-route confusion bug and reported it through WordPress’s HackerOne program; a separately reported SQL injection issue affecting the 6.8.x branch chains into it to reach code execution on 6.9.x and 7.0.x. Searchlight initially withheld technical detail to give site owners time to patch and released a public checker tool instead of proof-of-concept code, but by July 18 both CVE identifiers and technical writeups had circulated, and WordPress pushed the fix through its forced automatic-update system that same day.
The original insight for defenders is that “auto-update happened” is not the same as “my site is patched.” WordPress’s forced update mechanism does not reach every host configuration, and Searchlight’s advisory is explicit that site owners should verify their installation actually received version 7.0.2 or 6.9.5 rather than assume it. Until that verification is done, blocking anonymous requests to /wp-json/batch/v1 at the WAF layer is the recommended stopgap, mirroring the kind of platform-hardening step covered in CyberTech’s reporting on Ubiquiti’s UniFi vulnerabilities.
Source: Searchlight Cyber
