WordPress runs roughly 43 percent of every website on the internet, a network of more than 500 million sites ranging from small blogs to major corporate storefronts. So when WordPress released what looked like an ordinary maintenance update in mid-July 2026, most site owners barely noticed. Underneath that unremarkable changelog, however, sat a repair for one of the most serious flaws in the platform’s history.

The vulnerability, nicknamed “wp2shell,” was not a single mistake but a chain of two problems living inside WordPress itself — in the core code, not in any third-party plug-in. An attacker needed neither a password, nor a login, nor a misconfigured theme. Simply sending a carefully shaped message to the right address was enough. Within seconds, a stranger could create a new administrator account, drop in their own software, and gain a shell on the server.

The chain has two links. The first, tracked as CVE-2026-63030, is a “route confusion” flaw in WordPress’s REST API batch endpoint. It is the door that lets an unauthenticated request reach parts of the system it should never see. The second link, CVE-2026-60137, is a SQL injection bug in the way WordPress processes a specific query parameter. Alone, each is concerning; together they unlock full remote code execution on an unmodified, default installation.

Because the flaw lived in the core, deactivating a plug-in or updating a theme would not help — the fix had to come from WordPress itself, which is exactly what it did. The patched releases, WordPress 6.9.5 and 7.0.2, were pushed out through the platform’s automatic update mechanism, silently protecting a large share of sites before most owners even knew the problem existed.

The broader lesson is one that web experts have been saying for years: security depends less on how complex a site is and more on how quickly its foundation software is updated. A “routine” patch notice is often the only thing standing between an ordinary website and a full takeover.

Knowledge takeaway: the “wp2shell” flaw was a two-part attack built into WordPress core itself, requiring no password, plug-in, or special setup. It was patched silently in mid-July 2026, a reminder that automatic updates are the cheapest and most powerful form of web security.