What Happened
Two chained WordPress core vulnerabilities, collectively dubbed “wp2shell” by the security community, reached the public exploit stage on July 18, 2026 when proof-of-concept code appeared on GitHub. By July 20, multiple security vendors confirmed active exploitation campaigns targeting unpatched WordPress installations.
The attack chain begins with CVE-2026-63030, an authentication bypass in the WordPress REST API’s batch-route processing. An attacker without any credentials sends a specially constructed batch request that exploits an array desynchronization flaw to bypass WordPress’s access controls entirely. Once past the gatekeeper, the attacker reaches CVE-2026-60137 — a SQL injection flaw embedded in WordPress core that becomes reachable only through the authenticated surface exposed by the first bug. Together, the two flaws yield unauthenticated remote code execution: no login, no credentials, no plugins required.
Affected versions span WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. WordPress.org treated this as a critical emergency and shipped patches in versions 7.0.2, 6.9.5, and 6.8.6 on July 17, 2026. Auto-updates pushed the fixes to most managed WordPress installations, but self-hosted sites with auto-updates disabled remain exposed. Source: BleepingComputer
Why This Matters for Canadian Organizations
WordPress powers an enormous share of Canadian web infrastructure. Government departments, municipal websites, hospitals, universities, credit unions, law firms, and the vast majority of Canadian small and medium businesses run WordPress. Many operate self-hosted installations on their own servers or through local hosting providers — precisely the environments that do not receive automatic WordPress core updates and are most likely to still be running a vulnerable version today.
The two-flaw chain requires no login and no plugin. Every exposed WordPress installation running an affected version is vulnerable the moment an attacker runs the public PoC. Post-exploitation scenarios range from defacement and SEO spam to full server takeover, credential theft, and ransomware staging. Organizations that process personal information of Canadians through their WordPress sites — e-commerce, patient portals, member databases, form submissions — face PIPEDA breach notification obligations if attacker access leads to unauthorized disclosure. The window between public PoC publication and mass exploitation in unpatched WordPress campaigns historically measures in hours, not days.
The Canadian Centre for Cyber Security has previously issued advisories on WordPress core exploitation waves. Given the severity and the public PoC, a CCCS alert for this campaign is likely. Canadian web hosting providers and managed WordPress vendors should treat this as a Severity 1 incident for any customer on an affected version.
What to Do
Update WordPress core to version 7.0.2, 6.9.5, or 6.8.6 immediately on every installation your organization operates or manages. Check the WordPress dashboard under Dashboard > Updates. If you manage multiple sites, use a centralized platform like MainWP, ManageWP, or your hosting panel to confirm patch status across all properties. Enable automatic background updates for WordPress core if not already active — this is the single most effective control against this class of vulnerability.
Review web server and WordPress access logs from July 18 onward for unusual REST API requests containing batch-route patterns or unexpected SQL activity. If your site shows signs of post-exploitation — new admin accounts, modified plugin files, unexpected outbound connections — treat it as a full compromise, restore from a clean backup taken before July 18, and apply patches before bringing it back online. Organizations that provide WordPress hosting or manage client sites bear responsibility for checking every managed installation before end of day today.
