Urgent WordPress 7.0.2 update (wp2shell). What does it mean if you send SMS via an API?

wp2shell is a pre-auth RCE vulnerability – remote code execution without authentication. An attacker needs no account, no password and no plugin – a default WordPress installation is vulnerable. Technically it combines a routing flaw in the REST API endpoint /wp-json/batch/v1 with a SQL injection.

The vulnerability was discovered by Adam Kues of Assetnote (Searchlight Cyber), who reported it through WordPress's HackerOne program. The 17 July 2026 releases close two vulnerabilities at once:

• CVE-2026-63030 – the main wp2shell chain (a REST API routing flaw that, together with SQL injection, leads to code execution),
• CVE-2026-60137 – a SQL injection in the WP_Query component.

The Assetnote team published a public tester at wp2shell.com that checks whether your installation is vulnerable. Since the tool is out in the open, assume attackers are using it too – so every hour counts.

The vulnerable code only appeared in the 6.9 branch (December 2025), so older installations are safe from this specific flaw. That does not mean you can skip updating them.

You can check your version number in the WordPress dashboard (Dashboard → Updates) or in the footer of the admin panel.

It is easy to think "it is just a website". But if you run your own integration on WordPress that sends SMS through the SENDLY API, somewhere in there – in wp-config.php, in the options table or in the plugin settings – sits your API token. With a vulnerability that grants code execution without logging in, an attacker can:

• read your API token and send SMS at your expense – classic bill-running, often at night and to foreign numbers,
• extract your customers' phone numbers from the orders database, which is personal data, with GDPR consequences,
• alter the content of the messages you send, for example injecting a phishing link into your notifications.

In other words: a hole in WordPress is not just a website problem for you, but also a problem for your SMS budget and your customers' trust. That is why we treat this update as urgent for our users.

1. Update WordPress to 7.0.2 (or 6.9.5 / 6.8.6). If you have automatic core updates enabled, it has probably already happened on its own – verify the version anyway.

2. Make a backup before updating and, if you have an unusual set of plugins, check compatibility on a test copy.

3. Can't update right away? Temporarily block anonymous access to the REST API, or specifically to the /wp-json/batch/v1 path, at your WAF (e.g. Cloudflare). That stops the attack vector before you apply the patch.

4. Test your installation at wp2shell.com after updating.

And now the SENDLY-specific part:

• If there is any suspicion that the site was compromised – generate a new API token in the SENDLY panel. The old one stops working immediately, so the attacker loses access.
• Keep the token in an environment variable or a secret, not in code committed to a repository.
• Use our limits and daily caps – even if the token leaks, they cap the scale of potential abuse. That is the layer that saves your budget when everything else fails.

This story is a good illustration of how much attention a self-built integration demands: someone has to maintain it, track WordPress core releases and react when a vulnerability like this appears. With everything else on your plate, it is easy to miss.

That is why we are working on an official plugin that integrates SENDLY with WooCommerce, and we will release it soon. It takes exactly this work off your hands:

• secure token storage and a simple, secure connection instead of pasting keys by hand,
• maintenance and compatibility with future WordPress and WooCommerce versions on our side – you get updates automatically,
• ready-made SMS notifications for order statuses, without writing any code of your own.

If you send SMS today with your own solution, you lose nothing. But as soon as the SENDLY WooCommerce plugin is available, switching to it means one less problem to watch over with every update like this. We will let you know on the blog and in the panel when it launches.

• The critical wp2shell vulnerability (CVE-2026-63030) lets attackers take over WordPress without logging in – update to 7.0.2 / 6.9.5 / 6.8.6 immediately.
• If you send SMS from WordPress through an API, your token and your customers' numbers are at stake – consider rotating the token after updating.
• Enable limits and caps in SENDLY as a safety net.
• Coming soon: the official SENDLY WooCommerce plugin that takes over maintaining the integration.