WordPress Sites Under Attack: New wp2shell RCE Exploits Now Public

Key Findings

• Two critical WordPress Core vulnerabilities (CVE-2026-63030 and CVE-2026-60137) can be chained together to achieve pre-authentication remote code execution

• Public exploits are now available for the wp2shell attack chain

• Affected versions are WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1

• WordPress has enabled forced automatic security updates due to severity

• Over 500 million websites worldwide use WordPress and are potentially at risk

• No plugins or valid credentials required for exploitation

Background

The wp2shell vulnerabilities represent a significant threat to WordPress installations because they target the core platform itself rather than third-party plugins. CVE-2026-63030 is a REST API batch-route confusion bug introduced in WordPress 6.9, while CVE-2026-60137 is an SQL injection flaw in the author__not_in parameter of WP_Query. When chained together, these flaws allow anonymous attackers to gain remote code execution on default WordPress installations with no preconditions.

Vulnerability Details

CVE-2026-63030 involves improper routing in the REST API batch endpoint at /wp-json/batch/v1. This confusion allows attackers to manipulate requests in ways the developers didn't anticipate. CVE-2026-60137 provides the injection point through the author__not_in parameter, enabling attackers to execute arbitrary SQL queries. Together, they create a complete exploitation chain that bypasses all authentication mechanisms.

Discovery and Disclosure

Cybersecurity researchers at Searchlight Cyber, specifically Adam Kues at Assetnote, discovered the flaws and responsibly reported them through WordPress's HackerOne program. The research team withheld technical details to provide organizations time to patch before public disclosure. They released wp2shell.com, an online tool that allows administrators to check whether their WordPress instances are vulnerable without exposing sensitive information.

Patching and Remediation

WordPress released patches on July 17, 2026, with version 7.0.2 and 6.9.5 addressing both vulnerabilities. The WordPress.org team enabled forced automatic updates across the auto-update system for affected supported versions. Site owners should update immediately to these patched versions.

For organizations unable to patch immediately, temporary mitigation involves blocking anonymous access to the REST API batch endpoint through security plugins or Web Application Firewall rules targeting /wp-json/batch/v1 and ?rest_route=/batch/v1. However, these measures may impact legitimate site functionality and should only serve as stopgaps until proper updates are deployed.

Impact Assessment

With over 500 million websites running WordPress, the potential impact of this vulnerability is enormous. The fact that exploitation requires no authentication, no plugins, and works on default installations makes this particularly dangerous. The scale of affected installations and ease of exploitation explain why WordPress took the unusual step of forcing automatic updates rather than leaving it to individual administrators.

Sources

• https://securityaffairs.com/195597/hacking/attackers-can-take-over-wordpress-sites-using-newly-released-wp2shell-exploits.html

• https://korben.info/en/wp2shell-hack-wordpress-without-plugin.html

• https://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now