TL;DR: On July 17, 2026 the WordPress security team published an advisory for CVE-2026-63030 and CVE-2026-60137, an unauthenticated remote-code-execution chain nicknamed "wp2shell" affecting WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on July 21, 2026 with a federal remediation deadline of July 24, 2026. Public exploits are circulating, so every self-hosted WordPress site in North Carolina, including chamber sites, nonprofits, dental practices, small manufacturers and contractors, needed 6.9.5 or 7.0.2 at the time. As of September 30, 2026 those builds are no longer enough: CVE-2026-87902 affects core from 4.7.0 through 7.1.1 and is fixed at 7.1.2, 7.0.6, 6.9.9, 6.8.10 and a patched release on every branch down to 4.7.37. Read the September 30 update below before you target a version.
Key takeaway: wp2shell is not a plugin bug; it is a WordPress core bug in the REST API. Any unpatched self-hosted WordPress site reachable on the public internet is exploitable by anyone with an off-the-shelf script. Patch or take offline in the next 24-48 hours; every hour after CISA KEV posts, the exposure gets louder.
Need help patching or hunting your site tonight? Contact Preferred Data Corporation at (336) 886-3282 for emergency WordPress triage. BBB A+ rated, serving High Point, Greensboro, Winston-Salem, Charlotte, Raleigh, Wilmington, and the Piedmont Triad since 1987.
Updated September 30, 2026: a second core flaw, and this one does not spare the old sites. On September 22 the WordPress security team shipped WordPress 7.1.2 for CVE-2026-87902, which its advisory describes as "an unauthenticated path traversal issue in page-template resolution leading to conditional remote code execution." CISA added it to the KEV catalog on September 25 as a remote file inclusion flaw. It was reported through WordPress's HackerOne program by researcher Robert Ressl, credited in that advisory.
wp2shell hit two recent branches, 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1. CVE-2026-87902 affects WordPress core from 4.7.0 through 7.1.1 - a range that opens in December 2016. The site that shrugged off July because nobody had touched it since 2019 is squarely inside this one.
Be precise about what it does, because the severity argument turns on it. The primitive is a local file inclusion: a crafted request makes get_page_template() include a readable .php file from outside the active theme directories. Including a PHP file runs whatever that file already does, so turning it into code of an attacker's choosing takes two further conditions, both documented by The Hacker News and CrowdSec: the active theme needs a top-level folder whose name starts with page-, and PHP needs a reachable file such as PEAR's pearcmd.php with register_argc_argv enabled. That last setting is off by default on PHP 8.5 and on by default on older versions, which is one more reason an aging site is the exposed one. No source describes an unconditional data-disclosure path, so do not let anyone tell you this one reads your database password on its own.
Scanning started fast and wide. CrowdSec's network recorded 322,680 matching signals between September 23 and 27, climbing from 14,938 a day to a 124,154 peak on the 27th, and its Live Exploit Tracker counted 30,813 unique source addresses sending matching requests as of September 28. Those are attempts rather than confirmed compromises, and they are commodity traffic: nobody picked your site, a script found it, and being a small shop nobody has heard of buys you nothing.
The two published severity scores disagree, and neither is a typo. The WordPress advisory rates it 9.2 critical under CVSS 4.0, where the theme and server requirements score as "attack requirements" and complexity stays low; CISA carries 8.1 high under CVSS 3.1, where those same requirements score as high attack complexity, as CrowdSec sets out. The disagreement settles how many of your installs the code-execution path actually reaches. It does not settle whether to patch, because CISA put it on KEV either way.
Find your branch, take that build. WordPress shipped a fix on every branch still eligible for security fixes, which it describes as a courtesy rather than a return to support:
- 7.1.x → 7.1.2; 7.0.x → 7.0.6; 6.9.x → 6.9.9; 6.8.x → 6.8.10
- 6.7.9, 6.6.9, 6.5.12, 6.4.12, 6.3.12, 6.2.13, 6.1.14, 6.0.16
- 5.9.18, 5.8.17, 5.7.19, 5.6.21, 5.5.22, 5.4.23, 5.3.25, 5.2.28, 5.1.26, 5.0.29
- 4.9.33, 4.8.32, 4.7.37
- WordPress 4.6 and earlier get no security updates at all, so there is no build to take and the site needs rebuilding or retiring
That list is the answer to "we cannot upgrade, the theme will break." A site frozen on 5.2 has a patched 5.2.28 waiting; it is a security-only release on the branch you already run, so it should not touch your theme. Back up first and check your contact form afterwards anyway, because a form that stops feeding the inside-sales inbox during a quote week is its own incident.
If you cannot get into the dashboard, you can still do most of this. Plenty of NC companies have a site an agency built years ago and nobody here holds the login. Two things work from outside: view the page source and look for a <meta name="generator" content="WordPress ..." /> tag, and try /readme.html on the domain. Both are often stripped by hardening or a security plugin, so their absence proves nothing and only a positive reading counts. When that fails, the fastest path is a paper trail rather than a phone call. Send the agency or host three lines: Please confirm the WordPress core version running on our site, confirm whether the CVE-2026-87902 fix released 22 September 2026 has been applied, and tell us the date it was applied. An answer closes it. Silence is itself the finding, and it is the one worth escalating.
What to do this week if you only do one thing: list every WordPress install your company owns, including the one the marketing agency built in 2018 and the microsite for a trade show that ended years ago, and check each version against the list above. The forgotten install is the one that gets found.
One warning about reusing the plan further down this post. Its structure holds for this flaw, but its indicators do not: the hunting step greps for /wp-json/batch/v1 and author__not_in, which are wp2shell's fingerprints. A path traversal in template resolution leaves neither, so a clean grep for those two strings says nothing at all about CVE-2026-87902. Treat the absence of published indicators for this flaw as a reason to patch and watch, never as an all-clear.
What is the wp2shell WordPress Core RCE Chain?
wp2shell is the community name for a two-CVE unauthenticated remote-code-execution chain in WordPress core, disclosed by Searchlight Cyber via GitHub Security Advisory on July 17, 2026. It combines a logic flaw in the REST API batch processor with a SQL injection in the posts endpoint to give an unauthenticated attacker full code execution on the web server.
The two CVEs are CVE-2026-63030, an interpretation-conflict flaw (CWE-436) in the /wp-json/batch/v1 dispatcher, and CVE-2026-60137, a SQL injection in the author__not_in parameter of the posts endpoint. Neither is a full RCE on its own; chained together, they are. Fixed versions are WordPress 6.9.5 and 7.0.2, per the advisory covered by BleepingComputer. WordPress powers roughly 43 percent of all websites according to W3Techs' 2026 CMS market share tracker, and the self-hosted population is heavily concentrated in the small-business web presence that defines main-street North Carolina.
Why Does the July 24 CISA KEV Deadline Matter to a Small Business?
Legally, CISA's Binding Operational Directive 22-01 only obligates federal civilian agencies to patch KEV entries by deadline. Practically, private-sector defenders, cyber-insurance carriers, MSPs, and threat actors all treat KEV as the definitive "exploitation confirmed" list. Once a CVE lands on KEV, the clock starts for everyone.
Three reasons the KEV deadline is a small-business event:
- Automated exploitation follows KEV within hours. Greenbone's wp2shell timeline analysis notes mass-scanning attempts jumped sharply within 24 hours of the July 21 KEV listing.
- Cyber insurance policies increasingly reference KEV. Most 2026 renewals require patching KEV entries within the CISA deadline; failure to patch can be argued as failure to maintain reasonable security and grounds for denied claims.
- Search engines flag compromised sites fast. Google Safe Browsing and Microsoft SmartScreen tag malicious WordPress sites within days, and a "Deceptive Site Ahead" warning wipes out organic traffic for weeks even after cleanup.
How Does the Exploit Chain Actually Work in Plain English?
The vulnerable code path is the REST API batch endpoint at /wp-json/batch/v1, enabled by default and reachable without authentication for read-only sub-requests. The batch processor validates URLs in one loop and dispatches handlers in a second loop, but the two loops use different arrays. When wp_parse_url() fails on a sub-request, the error is pushed to the validation array but never to the matches array, desynchronizing the two by one index for every subsequent request and dispatching them to the wrong handlers. Combined with the SQL injection in author__not_in, an attacker uses the mis-routing to write a PHP web shell to the uploads directory and get command execution as the web server user.
Three technical points matter for defenders:
- The exploit is unauthenticated and requires no user interaction. No admin credentials, no logged-in user, no clicked link.
- The CVSS base score is 9.8 (Critical) per Rapid7's Emergent Threat Response team.
- Public PoCs have circulated since July 19, 2026 per BleepingComputer, meaning every commodity botnet operator has working code.
Who Is Actively Exploiting This Right Now?
Post-exploitation payloads observed as of July 22-23, 2026 fall into three buckets per Rapid7 and Picus Security: cryptomining, SEO poisoning and malware injection, and ransomware staging. All three target small-business sites because those have the weakest detection coverage.
Rapid7's Emergent Threat Response reports a common two-stage compromise: a lightweight web shell first, then a follow-on payload hours or days later. Operators frequently plant persistence via modified wp-config.php, backdoored must-use plugins, or hidden admin users, so patching alone does not remove an existing compromise. For a High Point manufacturer, a Charlotte law firm, or a Greensboro nonprofit, the practical risk is your domain becoming a phishing lure for your own customers, SEO poisoned with spam for months, or the compromise pivoting into email or hosting accounts. The 2024 Sucuri hacked website report found 39 percent of infected sites had at least one backdoor in addition to the initial payload, so cleanup without a real forensic pass rarely holds.
What Does a 72-Hour NC SMB WordPress Emergency Response Look Like?
For any self-hosted WordPress site owned by a North Carolina small business, this is the honest playbook. The KEV deadline was July 24, 2026 and mass scanning is already underway.
Hour 0-2, confirm exposure. Identify every WordPress site your organization runs, including dev, subdomains, and the old brochure site nobody uses. Read the core version in Dashboard, Updates. For wp2shell, 6.9.0-6.9.4 or 7.0.0-7.0.1 is vulnerable; for CVE-2026-87902 the range is 4.7.0 through 7.1.1, so check against both rather than clearing a site because it is older than the wp2shell range. If you cannot access the dashboard because a contractor built it in 2019, contact PDC at (336) 886-3282 now.
Hour 2-6, patch or take offline. Back up files and database before patching (SFTP plus phpMyAdmin if your host does not do snapshots). Update core to the patched release on your branch, 7.1.2 or 7.0.6 / 6.9.9 / 6.8.10 and downward as listed in the September 30 update above, and confirm the version string changed. 6.9.5 and 7.0.2 close wp2shell and leave CVE-2026-87902 open. If patching is blocked, the request has to be stopped before PHP runs: a static holding page served by the host, reverse proxy or CDN, or the origin stopped outright. A WordPress maintenance-mode plugin does not qualify, because a plugin is loaded by WordPress itself, so the request still bootstraps the application and may still reach the vulnerable template-resolution path before the plugin renders anything. Blocking /wp-json/batch/v1 at the WAF or web server does not qualify either: that is a control for wp2shell only, since CVE-2026-87902 arrives through page-template resolution and never touches that endpoint. No equivalent single-path block has been published for CVE-2026-87902, so anything short of keeping requests away from WordPress entirely should be treated as unmitigated.
Hour 6-24, hunt for existing compromise. Check wp-content/uploads/ for .php files (uploads should never contain PHP). Check wp-content/mu-plugins/ and wp-content/plugins/ for files modified since July 17 that do not match a known plugin update. Review wp_users for unfamiliar admin accounts and wp_options siteurl/home for tampering. Grep web server logs from July 17, 2026 forward for POSTs to /wp-json/batch/v1 and requests containing author__not_in. Those two strings are wp2shell's fingerprints and nothing else's: a clean result says nothing about CVE-2026-87902, which leaves neither. Treat the absence of published indicators for the September flaw as a reason to patch and keep watching, never as an all-clear.
Hour 24-72, harden and monitor. Rotate every credential the site has ever seen (WordPress admin, database, SFTP, hosting panel, API keys in wp-config.php). Put a WAF in front of the site if you do not already have one, and enable file-integrity monitoring so any future unexpected .php file alerts within minutes.
If the hunt step turns up anything suspicious, treat it as a confirmed incident and escalate to a professional incident-response firm rather than cleaning it yourself. WordPress compromises are among the most persistent on the internet.
Not sure where to start? Call Preferred Data Corporation at (336) 886-3282 or visit 1208 Eastchester Drive, Suite 131, High Point, NC 27265 for on-site emergency response within 200 miles of High Point, including the Triangle and Charlotte metros.
What Does Long-Term WordPress Hardening Look Like Beyond This Patch?
wp2shell is the third serious WordPress core RCE in the past 24 months, and the pattern is not going to change. If your website is a real revenue channel, the hosting model matters as much as the software. Four common paths for NC small businesses:
| Hosting Path | Monthly Cost | Patch Speed | Security Posture | Best For |
|---|---|---|---|---|
| Shared / cheap VPS, self-managed | $10-40 | Owner-dependent, often months late | Weak; no WAF, no hardening | Nobody in 2026 |
| Self-hosted with managed IT provider | $75-300 | Same-day for KEV | Strong; WAF, FIM, tested backups | Sites with custom code and integrations |
| Managed WordPress host (WP Engine, Kinsta, Pressable) | $30-300+ | Automatic within 24-72 hours | Strong; provider handles core, WAF, backups | Standard marketing sites |
| Static / JAMstack (Astro, Hugo, Next.js on Cloudflare Pages or Netlify) | $0-50 | No CMS attack surface | Very strong; no runtime PHP | Brochure sites, blogs, content sites |
A brochure site for a Winston-Salem construction firm that changes twice a year belongs on a static site generator, not self-hosted WordPress. A Piedmont Triad manufacturer running a distributor portal or lead-capture forms belongs on managed WordPress hosting or a headless CMS behind a professionally-managed stack. The cheap-VPS-plus-nobody-watching model that dominated NC SMB websites from 2010 to 2024 is no longer defensible. Working with a managed IT provider means core patches land within the KEV window every time, backups are tested, and the network posture surrounding the site is engineered rather than assumed.
How Much Does a Compromised WordPress Site Cost an NC Small Business?
A serious WordPress compromise is rarely just a cleanup bill. Costs stack across five categories:
- Direct incident response: $2,500-$15,000 for a forensic pass, backdoor removal, and rebuild. Cheap malware-cleanup services often miss persistence and invite reinfection.
- Downtime and lost leads: A five-day outage or Google flag during buying season for a Charlotte or Raleigh small business can easily represent tens of thousands in pipeline.
- SEO recovery: Per Sucuri's 2024 hacked website report, removing a Google Safe Browsing warning takes days to weeks, and organic ranking recovery from a "hacked site" designation often takes three to six months.
- Cyber-insurance and legal: IBM's 2024 Cost of a Data Breach Report put the average breach at $4.88 million globally, with SMB incidents typically ranging from $120,000 to $1.2 million. A compromise that exposes form submissions can trigger NC Identity Theft Protection Act notification obligations with real legal costs.
- Brand damage: Prospects who search your brand and see "This site may be hacked" do not call back.
Preventive spend, whether $150 per month for professional WordPress management or a one-time migration to a static site, beats reactive spend by an order of magnitude.
Ready to fix this for good? Contact Preferred Data Corporation at (336) 886-3282. Serving manufacturers, professional-services firms, and nonprofits across North Carolina since 1987.
Frequently Asked Questions
We are on WordPress.com, not self-hosted. Are we affected?
No. wp2shell affects self-hosted WordPress from wordpress.org. Sites on WordPress.com (Automattic's managed service) were patched centrally before public disclosure. If unsure which you have, yoursite.wordpress.com or a mapped domain with WordPress.com billing means managed; yoursite.com/wp-admin with your own hosting bill means self-hosted and in scope.
We use managed WordPress hosting (WP Engine, Kinsta, Pressable). Are we protected?
Mostly yes, but verify. Reputable managed WordPress hosts patched core within hours of the July 17, 2026 advisory. Log in to your host's dashboard, confirm the patched release for your branch is running (7.1.2, or 7.0.6 / 6.9.9 / 6.8.10 and downward), and check for a host-published notice. If your host has not confirmed patching, escalate a ticket and treat the site as vulnerable until they respond.
Our WordPress site is behind Cloudflare. Does that block wp2shell?
Only if you have Cloudflare's WAF (paid tier or the WordPress-specific managed ruleset) actively enabled. The free tier gives you DDoS protection and TLS but not the WAF rules that block the batch-endpoint exploit pattern. Cloudflare published a managed rule for CVE-2026-63030 within 48 hours of disclosure; if you are on a paid plan, confirm it is enabled. A WAF is a compensating control, not a substitute for patching.
Read that answer as being about wp2shell only. A rule keyed to the /wp-json/batch/v1 exploit pattern has nothing to match on for CVE-2026-87902, which arrives as an ordinary front-end request that resolves a page template, and we have not found a published managed rule for it. So do not treat a Cloudflare paid plan as coverage for the September flaw. Patch to the release on your branch.
How do we tell if our WordPress site has already been compromised?
Look for unexpected .php files in wp-content/uploads/, review wp_users for admin accounts you do not recognize and wp_options siteurl/home for changes, and grep web server logs from July 17, 2026 forward for POSTs to /wp-json/batch/v1 or requests containing author__not_in. Any hits warrant a professional incident-response engagement rather than a self-cleanup. Note the limit of that last check: those strings belong to wp2shell alone. CVE-2026-87902 arrives through page-template resolution and leaves neither, so a clean grep is not evidence about the September flaw, and the file checks above are the part that still applies to both.
What is the difference between a WordPress core CVE and a plugin CVE?
A core CVE (like wp2shell) affects every self-hosted site regardless of theme or plugins. A plugin CVE only impacts sites running that plugin. Core CVEs are rarer but much broader in blast radius; plugin CVEs are far more common (hundreds per year per Patchstack's annual reports). Both need to be tracked, but a core RCE like wp2shell is the drop-everything tier.
We have not touched our WordPress site in three years. What should we do?
Take it offline this week and decide what it is worth. If it is a live marketing asset producing leads, migrate it to managed WordPress hosting or a static site generator and rebuild the content properly. If it is dormant, put a static page in front of it and shut the WordPress install down entirely. The safest three-year-old WordPress install is one that is no longer running.
If we get breached, do we need to notify anyone in North Carolina?
Possibly. The NC Identity Theft Protection Act (N.C.G.S. 75-65) requires notification of NC residents without unreasonable delay when personal information is compromised. WordPress sites often store more sensitive data than owners realize: form submissions, WooCommerce order history, subscriber lists. Notify your cyber-insurance carrier first (they usually have breach-counsel panels), then work with legal counsel on state notification obligations before contacting affected individuals.
Is it cheaper for us to migrate off WordPress now?
For most NC small-business brochure sites, yes. A migration to a static site generator (Astro, Hugo, or Eleventy on Cloudflare Pages or Netlify) typically runs $3,000-$15,000, eliminates the entire class of PHP/database vulnerabilities, and cuts hosting costs to near zero. If your site depends on WooCommerce, MemberPress, or complex Gravity Forms workflows, managed WordPress hosting is usually the better path. A managed IT provider or custom software team can help decide which pattern fits your business.