Public exploits have been released for a pair of critical vulnerabilities in WordPress Core, collectively known as "wp2shell," placing millions of websites at immediate risk of remote code execution. Security researchers confirm that attackers have already begun exploiting the flaws in the wild, making emergency patching a necessity for server administrators. Discovered by Adam Kues from Searchlight Cyber, the wp2shell attack chain consists of two separate vulnerabilities: CVE-2026-63030 and CVE-2026-60137. When used together, they allow attackers to execute pre-authentication remote code against default WordPress installations running versions 6.9.x and 7.0.x. "The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins," Searchlight Cyber stated in its report. The root of the wp2shell attack lies in combining a REST API batch-route confusion bug (CVE-2026-63030), introduced in WordPress 6.9, with a high-severity SQL injection vulnerability (CVE-2026-60137) found in the 'author__not_in' parameter of 'WP_Query'. While the SQL injection flaw independently affects WordPress versions 6.8.0 through 6.8.5, it cannot be chained for remote code execution in those older builds since the required REST API bug was not added until version 6.9. The complete RCE chain specifically impacts WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Recognizing the severe threat to the estimated 500 million websites running the platform, the WordPress security team initiated forced automatic updates for supported affected versions. "Because this is a security release, it is recommended that you update your sites immediately," the developers announced. "Due to the severity, the WordPress.org team have enabled forced updates via the auto-update system for sites running affected versions." Site owners are instructed to manually verify their installations are running the patched releases, WordPress 7.0.2 or 6.9.5. Searchlight Cyber initially withheld complete technical specifics to provide a patching window, instead launching a dedicated website at wp2shell.com for administrators to test their exposure. Infrastructure providers also stepped in; Cloudflare deployed Web Application Firewall (WAF) protections for both vulnerabilities across all of its plans, including free accounts. However, Cloudflare warned that "WAF protections reduce exposure while customers update, but they are not a substitute for patching." Despite efforts to delay technical disclosures, multiple proof-of-concept exploits quickly surfaced on GitHub. Some of these publicly available scripts combine the two vulnerabilities to extract WordPress administrator password hashes via SQL injection, crack them, and then log in to upload a malicious plugin for command execution. Other proof-of-concepts claim to achieve full pre-authentication remote code execution without any administrator credentials, aligning with Searchlight Cyber's initial description. Security publication BleepingComputer has contacted Searchlight Cyber to confirm their specific attack chain does not require a password. The theoretical threat has rapidly evolved into an active crisis. Security firm watchTowr confirmed that malicious actors are already using the public exploits to attack servers. "WordPress gets a bad rap for security. But the reality is that a highly impactful, unauthenticated SQL injection or remote code execution vulnerability in WordPress core is actually fairly rare," watchTowr CEO Benjamin Harris told BleepingComputer. "That is exactly what makes this one different, and why everyone is scrambling to patch before widespread exploitation takes hold. The watchTowr team is already seeing PoC exploits in circulation, and we are beginning to see the first signs of in-the-wild exploitation." Somali web developers and business owners managing local news portals, e-commerce stores, or company pages on WordPress must immediately check their administrative dashboards and confirm they are running version 7.0.2 or 6.9.5 to prevent unauthorized code execution.