WordPress Shell Woes, WOW Updates - July 2026
Welcome to Hot Web Dev July 2026, featuring the latest in web development. This month, we discuss a serious WordPress vulnerability and why it's important to keep your software updated. There is an update on my recent job switch and why you should never give up. The tool of the month is a terminal treasure.
Table of contents:
- WordPress Shell Vulnerability
- Coding Resources
- Learning Resources
- WOW Tool Of The Month
- Must-Read Resources From July 2026
WordPress Shell Vulnerabilty
This month's security vulnerability affected the WordPress core and not a plugin or theme. The wp2shell vulnerability allowed unauthorised attackers to run code from afar. WordPress's security release notes mention it as CVE-2026-63030. It explains that it’s 'REST API batch-route confusion and SQL injection' that can lead to remote code execution. The main entry point is the batch endpoint at /wp-json/batch/v1 or the older query-string alias ?rest_route=/batch/v1.
Also in the same release, there was another critical SQL injection vulnerability, CVE-2026-60137, unrelated to wp2shell. This vulnerability goes back even further than wp2shell, so it was also backported to 6.8.6. On the other hand, the wp2shell vulnerability only affects versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1.
WordPress is used by about four in ten websites. A pre-auth core Remote Code Execution (RCE) with no conditions is pretty serious for this ecosystem. The project decided to force updates through its auto-update system.
This bug also points to a common weakness in the core software. WordPress's REST API batch endpoint groups several smaller requests into a single one. It’s a handy feature, but it often pops up after the authentication and routing stuff around it has been put together and checked. This gap is where bugs like this usually happen: a route that the framework trusts too much.
Defenders need to act quickly to fix the wp2shell vulnerability. Since it's so important and could be exploited quickly, it’s crucial to prioritise patching and securing the affected systems. This means making sure all WordPress installations are up to date, especially those running the affected branch. Also, defenders should keep an eye out for any signs of exploitation and take steps to reduce the risk.
Make sure every WordPress installation that connects to the internet actually got the update. Don’t just take it for granted; some sites might have turned off automatic updates on the server side, or they might be stuck on a single version because of a management tool. These sites might have missed the update completely. There's a public checker at wp2shell.com that lets site owners check if they're affected.
For anyone managing multiple WordPress sites, it might also be worth considering a simpler check: would your monitoring even notice a sudden increase in anonymous POST requests to a batch endpoint that most administrators do not think about? The wp2shell vulnerability shows that the parts of the core that are often overlooked are exactly where a critical bug is. The next one might not be as obvious as this one.
Elsewhere in the devsphere, Node.js has issued security updates for versions 22, 24 and 26.
On a personal note, I recently switched from WordPress to GravCMS, so I was unaffected. However, I have had the pleasure of cleaning up a few infected sites. If anything can be learned from all the recent exploits, as we rely more on AI for development, it is to keep your software up to date. AI is wonderful, but it can be used in bad ways too.
Sources
Coding Resources
July has been a busy time for me. I left my job in education after 11 years and started as a Web & Database Developer at The James Hutton Institute. My path into IT hasn't been straightforward, despite loving technology and computers for the majority of my life. I have been building websites since the 2000's and have run this very blog since 2008. In the background, I have always questioned whether I am good enough, which is called Imposter Syndrome. Believing that someone else can do the job better than you. It wasn't until I started a degree before the COVID-19 pandemic that I began to believe in myself more.
I worked full-time while also studying part-time to complete my degree by 2025. Despite applying for numerous jobs on LinkedIn, I received numerous rejections and no interviews. I attended some CV workshops through the Open University and realised that I needed to change my CV to a skills-based one as I was trying to switch from education to IT. My CV now highlights my 11-year teaching experience, including computer science, my blog and charity work. If you are in the same situation, don't give in. Find ways to improve your CV to make it more appealing to employers. I got my job through Adzuna after having many failed attempts through LinkedIn.
To freshen up my development environment, I like to change the coding font, preferably to one with ligatures. Currently, I switch between JetBrains Mono and Cascadia Code. If you fancy a freshen-up yourself, then take a look at The Best Coding Fonts.
Modern JavaScript offers built-in features that reduce boilerplate and improve code readability. This article highlights ten techniques to streamline code and avoid common pitfalls.
Learning Resources
If you want to learn how servers and clients communicate, this handbook delves into the intricacies of client-server communication, exploring protocols, trade-offs, and historical context. It goes beyond basic API knowledge, providing a deep understanding of communication technologies and empowering engineers to make informed architectural decisions.
This written guide by FreeCodeCamp highlights how common JavaScript bugs occur when API responses differ from expectations, causing errors. This can be prevented using TypeScript guard utilities such as safeArray, safeString, safeNumber, and safeObject, which enhance application reliability.
Finally, to finish off this month's learning section, you can learn more about Docker and learn React.
WOW Tool of the Month
I am using the command line more in both my professional and home life. Superfile is a beautifully crafted terminal application that offers a user interface comparable to your favourite applications.
It provides a comprehensive set of functions including file copy, move, delete, rename, fuzzy search, bulk operations and image preview. Superfile is fully customisable, allowing you to remap hotkeys, select a theme and adjust borders and colours to suit your workflow.
The application also supports multiple panels, enabling you to split into multiple directory panes simultaneously and copy and paste across them with a few keystrokes. SuperFile extends functionality with community plugins such as Git status integration, system monitoring and custom commands.
The application also features a wide range of built-in themes including Catppuccin, Nord, Tokyo Night, Dracula, Gruvbox and Rose Pine.