wp2shell test — is your WordPress vulnerable?

On 17 Jul 2026 a critical pre-authentication RCE landed in WordPress core itself, nicknamed wp2shell. An anonymous request against a stock install can run code on the server — no login, no plugins. Vibe Check inspects your site from its public URL and passively tells you whether your WordPress version falls in the vulnerable range.

What wp2shell is (CVE-2026-63030 + CVE-2026-60137)

wp2shell is a pre-auth RCE in WordPress core, not a plugin. It chains a SQL injection in WP_Query (CVE-2026-60137) and a route confusion in the REST batch API /wp-json/batch/v1 (CVE-2026-63030). The batch API has shipped in core since 5.6, enabled by default and unauthenticated.

Affected and fixed versions

• Affected: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1.
• Fixed in 6.9.5 (6.9 branch) and 7.0.2 (7.0 branch).
• Affects an estimated 500 million+ WordPress sites.

How Grove detects it — passively

Vibe Check reads the WordPress core version from public traces (generator meta, the ?ver parameter on core assets, readme.html) and compares it deterministically against the wp2shell vulnerable range. If the site is hardened and the version hidden, it only safely checks whether the REST batch API is exposed. The check is purely passive: no SQL injection, no exploit, no access to your code or server.

How to fix it

Update WordPress to 7.0.2 (or 6.9.5 on the 6.9 branch). Until you can, block anonymous access to /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF.