Critical wp2shell WordPress Vulnerability Exposes Systems to Unauthenticated Remote Code Execution

Jul 18
3 min read

Key Findings

Anonymous HTTP requests can execute code on WordPress sites running core versions 6.9 through 7.0.1 without any plugins or authentication
Two chained vulnerabilities, now assigned CVE-2026-63030 and CVE-2026-60137, combine a REST API batch-route confusion with SQL injection to bypass all protections
WordPress patched the issue Friday with forced auto-updates to versions 6.9.5 and 7.0.2, but sites with auto-updates disabled remain vulnerable
Full technical details and working proof-of-concept code are now public on GitHub
Exploitation has not been confirmed in the wild as of July 18, 2026, but mass WordPress exploitation is an established industry threat

Background

The vulnerability was discovered by Adam Kues at Assetnote and reported through WordPress's HackerOne program. The SQL injection component was separately reported by TF1T, dtro, and haongo. Searchlight Cyber, Assetnote's attack surface management division, published analysis under the name wp2shell and has maintained a checker tool at wp2shell.com to help site owners identify their exposure.

How the Attack Works

The flaw consists of two distinct bugs that chain together. CVE-2026-60137 is a SQL injection in the WP_Query author__not_in parameter that gets triggered when a string is passed instead of an array, bypassing the expected validation. CVE-2026-63030 is a batch endpoint confusion bug that allows attackers to misalign parallel request tracking arrays by one position, causing requests to execute under the wrong handler and walk past endpoint whitelists.

When combined through the REST API batch route at /wp-json/batch/v1, an attacker can nest requests to slip malicious input past the endpoint's security checks directly into the vulnerable SQL query. The entire chain requires no authentication and works on default WordPress installations.

Affected Versions and Exposure

The vulnerability affects different WordPress versions in distinct ways. The SQL injection alone dates back to version 6.8.0, but unauthenticated remote code execution only becomes possible with the batch-route confusion introduced in version 6.9. This splits the exposure into three groups:

Versions 6.8.0 through 6.8.5 contain only the SQL injection, now fixed in 6.8.6
Versions 6.9.0 through 6.9.4 contain the full RCE chain, fixed in 6.9.5
Versions 7.0.0 through 7.0.1 contain the full RCE chain, fixed in 7.0.2

Every site vulnerable to code execution is running software less than eight months old since WordPress 6.9 shipped on December 2, 2025. WordPress estimates over 500 million websites run WordPress overall, though exact numbers for the exposed subset remain undisclosed.

Patching and Auto-Updates

WordPress deployed patches Friday and enabled forced updates through its auto-update system for affected versions. However, the company has not clarified whether forced updates reach sites that previously disabled auto-updates. Site administrators should verify their actual WordPress version rather than assume updates landed automatically.

Scoring and Technical Assessment

WordPress itself rated the RCE chain as Critical, but the official CVE score for the batch-route confusion sits at 7.5, classified only as High. This discrepancy exists because scoring rewards the SQL injection's direct database access over the route confusion's impact. The injection component scores higher on severity metrics. Security teams should track both CVE numbers rather than relying on either label alone.

A Narrower Window Exists

One condition reduces exposure: the code-execution path only works when a site is not running a persistent object cache like Redis or Memcached. Cloudflare released WAF rules acknowledging this condition. However, default WordPress installations have no persistent cache, leaving standard deployments fully exposed. Cache deployment is a side effect, not a proper fix, and it does not prevent the underlying SQL injection.

Detection and Response Timeline

Vulnerability scanners are now catching up. Rapid7 announced authenticated checks for InsightVM and Nexpose coming July 20. The vulnerability does not yet appear on CISA's Known Exploited Vulnerabilities catalog, which requires confirmed exploitation. No attacks have been reported as of July 18, but that timeline provides little comfort given WordPress's history as a mass-exploitation target.

Prior to this disclosure, a single caching-plugin vulnerability deployed the WP-SHELLSTORM crew into over 17,000 sites using a bug that was already public, already patched, and only worked on non-default configurations. This flaw is public, patched, and works on default settings, creating significantly higher exploitation risk.

Sources

https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html
https://www.socdefenders.ai/item/36050f41-ec4b-4a00-8120-e216930b59e1
https://x.com/TheCyberSecHub/status/2078234599273144768
https://www.linkedin.com/posts/cybercureme_new-wp2shell-wordpress-core-flaw-lets-unauthenticated-activity-7484000545301647360-E-3D