TL;DR: A critical pre-authentication Remote Code Execution (RCE) vulnerability, dubbed “wp2shell” (CVE-2026-63030), has been identified in WordPress Core. This vulnerability allows an unauthenticated attacker to execute arbitrary code on a vulnerable WordPress installation without any preconditions, such as plugins or specific configurations. 
Given that WordPress powers over 500 million websites, this vulnerability poses a significant risk to the global web ecosystem. 

Vulnerability Overview  

The vulnerability exists within the WordPress REST API, specifically affecting the /wp-json/batch/v1 and ?rest_route=/batch/v1 endpoints. An unauthenticated attacker can exploit this endpoint to achieve RCE.

Affected WordPress Versions: 

• 6.9.0 – 6.9.4 (Fixed in 6.9.5) 

• 7.0.0 – 7.0.1 (Fixed in 7.0.2) 

(Note: WordPress versions older than 6.9.0 are not affected by this specific vulnerability.)

Mitigation and Protection 

Imperva customers with both Cloud WAF and WAF-GW deployments are protected against exploitation attempts associated with the “wp2shell” vulnerability. Cloud WAF automatically inspects and blocks requests targeting the vulnerable REST API endpoints at the edge, mitigating the risk before it reaches your backend services. 

For organizations utilizing WAF-GW, we are providing policy updates to further harden protection. Administrators should apply the latest security policy updates to their WAF-GW environments to ensure these enhanced inspection capabilities are active. These updates provide another layer of defense, blocking the specific patterns associated with unauthorized batch API access before they can be processed by the WordPress core.

Recommended Best Practices 

While Imperva provides protection at the edge, we strongly recommend that all WordPress administrators take the following steps: 

1. Update Immediately: Ensure your WordPress installation is updated to the latest secure versions (6.9.5 or 7.0.2) as soon as possible. This is the only definitive way to resolve the underlying vulnerability. 
2. Emergency Mitigation: If an immediate upgrade is not possible, you can temporarily mitigate the risk by blocking access to the affected REST API endpoints:
   • Block requests to the path: /wp-json/batch/v1
   • Block requests containing the query parameter: rest_route=/batch/v1 

Note: These mitigation measures may impact legitimate site functionality and should only be used as a temporary stopgap until you are able to perform the necessary software updates. For more technical details regarding the vulnerability discovery, please refer to the official research advisory from Searchlight Cyber.