wp2shell: Pre-Auth RCE in WordPress Core, Patched Without a CVE

Searchlight Cyber disclosed wp2shell, a pre-authentication remote code execution vulnerability in WordPress core. Patches landed in versions 7.0.2 and 6.9.5, but no CVE has been assigned and WordPress.org has not issued a structured advisory.

Searchlight Cyber has disclosed wp2shell, a pre-authentication remote code execution vulnerability affecting WordPress core without requiring additional plugins. The disclosure comes with patches already available — versions 7.0.2 and 6.9.5 — but no assigned CVE identifier and no structured advisory from WordPress.org. This disclosure rests solely on Searchlight Cyber; no independent verification or confirmation from WordPress.org is available.

The discovery, attributed to Searchlight Cyber researcher Adam Kues, includes a reference to the use of GPT-5 in the vulnerability discovery process. Available sources do not specify the model's actual role in the discovery chain.

Key Takeaways

The wp2shell vulnerability enables pre-auth RCE on stock WordPress installations, no plugins or special configurations required
The attack vector is the REST Batch API endpoint, reachable via /wp-json/batch/v1 and ?rest_route=/batch/v1
WordPress released patches 7.0.2 and 6.9.5 without publishing a CVE or detailed vendor advisory
Searchlight Cyber estimates over 500 million WordPress sites are potentially affected
Technical details withheld for coordinated disclosure; the source does not specify when they will be published

The Attack Mechanism: How wp2shell Works

Searchlight Cyber identified the entry vector in WordPress's REST Batch API, an interface designed to bundle multiple API requests into a single call. According to the researcher's advisory, the attack "has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins."

The batch API is accessible through two URI patterns: /wp-json/batch/v1 and, in configurations with pretty permalinks disabled, ?rest_route=/batch/v1. Available sources do not specify whether both patterns are necessarily exposed in all configurations.

The researcher has not released full technical details of the exploit mechanism. The stated reason is coordinated disclosure: "Given the severity of the flaw and to give defenders time to apply patches, we are not releasing technical details at this time." Available sources do not document whether WordPress.org has published or scheduled a full release of technical details.

"The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins" — Searchlight Cyber advisory

Disclosure With Gaps: Patches Without a CVE or Vendor Advisory

The release of versions 7.0.2 and 6.9.5 occurred without a CVE publication by a recognized CNA and without a structured advisory from WordPress.org. Searchlight Cyber characterizes its approach as "coordinated disclosure."

The absence of a CVE identifier has operational consequences. Vulnerability management tools rely on standardized identifiers to correlate scans, tickets, and reports. Without a CVE, the WordPress 7.0.2 patch may not be automatically recognized as a critical security fix. No information is available on any future CVE assignment.

Similarly, the lack of a CVSS score prevents quantitative severity classification. Searchlight Cyber describes the flaw as "high severity," but without standardized metrics this assessment is not comparable with other vulnerabilities. Available sources report no CVSS score.

GPT-5 in the Discovery Chain: An Undocumented Reference

The wp2shell.com site, operated by the same researcher, includes the reference: "Read how the bug was found with GPT-5." Available sources do not specify GPT-5's actual role — whether instrumental in generating hypotheses, analyzing code, or post-discovery synthesis — nor do they provide details on the human verification pipeline.

Adam Kues of Searchlight Cyber is documented as the author of the discovery and documentation. The GPT-5 reference may reflect genuine methodology, a commercial positioning element, or both; available sources do not allow determining which hypothesis is correct.

What to Do Now

Priority actions derive from the primary sources analyzed:

Update to WordPress 7.0.2 or 6.9.5: Searchlight Cyber identifies these versions as patched for their respective branches. Updating is the only definitive mitigation documented by the source.
Block anonymous access to the REST Batch API: Pending update, Searchlight Cyber suggests filtering requests to /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF or plugin level. The proposed mitigation code hooks the rest_pre_dispatch filter to block the /batch/v1 endpoint for unauthenticated users.
Verify your exposure: The wp2shell.com site offers a check tool indicating whether a specific WordPress installation appears vulnerable. The tool's code has not been independently verified.

The self-promotional nature of the disclosure and the absence of independent verification demand caution in risk assessment. Administrators must balance the potential severity of a pre-auth RCE in core — with over 500 million sites estimated affected — against the informational limits of the single structured primary source available.

Source Limitations and Context

This analysis relies exclusively on Searchlight Cyber (slcyber.io) and its associated tool wp2shell.com. Both are products of the same entity. The following are unavailable: confirmation from WordPress.org, independent verification of the RCE claim, technical details of the exploit mechanism, an assigned CVE, a CVSS score, or information on any in-the-wild exploitation.

Coordinated disclosure — with patches released but technical details withheld — is a legitimate practice, but in the absence of a vendor advisory it leaves defenders with an information asymmetry relative to attackers who have access to the patched code. Available sources do not document whether WordPress.org has addressed this asymmetry through internal CNA communications or other initiatives.

Information is current as of publication. The lack of independent sources and the self-promotional nature of the vendor constitute the primary limitations of this analysis.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references