Executive Summary
The WP2Shell vulnerability chain represents a critical and actively exploited threat to the global WordPress ecosystem. Comprising two distinct but chainable flaws—CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection in WP_Query)—this attack vector enables unauthenticated remote code execution (RCE) on default WordPress installations, even in the absence of third-party plugins. Public proof-of-concept (PoC) exploits are widely available, and multiple security vendors have confirmed exploitation in the wild as of July 2026. The scale of exposure is unprecedented, with hundreds of millions of sites at risk. Immediate patching is mandatory to prevent compromise.
Threat Actor Profile
Current intelligence indicates that exploitation of WP2Shell is opportunistic and widespread, with no single advanced persistent threat (APT) group attributed as of this writing. The attack surface is being targeted by a range of cybercriminal entities, including the WP-SHELLSTORM crew, which has a history of mass exploitation of WordPress vulnerabilities. These actors are leveraging automated tools and botnets to scan for and compromise vulnerable sites at scale. The primary motivation appears to be mass webshell deployment, credential theft, and the establishment of persistent access for further monetization through spam, phishing, and malware distribution. While no nation-state campaigns have been confirmed, the technical sophistication of the exploit chain and the rapid weaponization by criminal groups underscore the criticality of the threat.
Technical Analysis of Malware/TTPs
The WP2Shell attack chain exploits two core vulnerabilities in WordPress:
The first, CVE-2026-63030, is a logic flaw in the /wp-json/batch/v1 REST API endpoint, introduced in WordPress 6.9. This endpoint is designed to process multiple REST API sub-requests in a single HTTP call. Due to improper synchronization of internal request arrays, an attacker can craft a batch request where a malformed sub-request causes subsequent requests to be routed to unintended handlers. This confusion allows bypassing of endpoint allow-lists and injection of arbitrary parameters into sensitive API calls.
The second, CVE-2026-60137, is a SQL injection vulnerability in the author__not_in parameter of the WP_Query class, present since WordPress 6.8. By passing a string instead of an array, type checks are bypassed, enabling direct injection of malicious SQL statements into database queries.
When chained, these vulnerabilities allow an unauthenticated attacker to inject SQL via the REST API, extract sensitive data such as password hashes, and, in many cases, escalate to full remote code execution. Attackers can upload malicious plugins or webshells, modify site content, or pivot to further compromise internal infrastructure.
Observed tactics, techniques, and procedures (TTPs) include automated scanning for vulnerable endpoints, exploitation via crafted batch requests, exfiltration of credential hashes, brute-forcing of admin accounts, and deployment of PHP-based webshells. Some attackers have been observed using the initial foothold to install additional malware or to launch secondary attacks against site visitors.
Exploitation in the Wild
Exploitation of WP2Shell is ongoing and global in scope. Public PoCs are available on platforms such as GitHub, and exploit code has been integrated into popular offensive security frameworks. Security firms including watchTowr and Searchlight Cyber have reported widespread scanning and exploitation attempts since July 18, 2026.
Attackers typically follow a multi-stage process: first, they exploit the batch-route confusion to inject SQL via the vulnerable parameter; next, they extract password hashes or directly execute code to establish persistence; finally, they deploy webshells or malicious plugins to maintain access and monetize the compromise. In some cases, attackers have bypassed multi-factor authentication by leveraging stolen session cookies or by resetting credentials via the compromised admin interface.
The scale of exploitation is significant, with estimates suggesting that over 500 million WordPress sites are potentially exposed, though only those running affected versions are directly exploitable. High-profile sites, e-commerce platforms, and government portals have all been targeted, with some incidents resulting in data breaches and defacement.
Victimology and Targeting
The WP2Shell vulnerabilities are being exploited indiscriminately, with no evidence of targeted campaigns against specific sectors or geographies. The primary victims are organizations and individuals running WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, as well as legacy 6.8.x installations (for SQLi only). Both small businesses and large enterprises have been affected, particularly those with default or poorly maintained installations.
Attackers are leveraging automated tools to identify and compromise vulnerable sites en masse. Once compromised, sites are often used as launchpads for further attacks, including phishing, malware distribution, and SEO poisoning. The presence of webshells and unauthorized plugins is a common indicator of compromise.
Mitigation and Countermeasures
Immediate action is required to mitigate the risk posed by WP2Shell. All organizations running WordPress should update to versions 6.9.5, 7.0.2, or later, which contain patches for both vulnerabilities. If immediate patching is not feasible, organizations should implement compensating controls, such as blocking anonymous access to the /wp-json/batch/v1 endpoint and the ?rest_route=/batch/v1 query via web application firewalls (WAFs) or security plugins. The use of the wp2shell.com vulnerability checker is recommended to assess exposure.
Additional best practices include monitoring for indicators of compromise, such as unusual requests to REST API endpoints, unexpected admin logins, and the presence of unknown PHP files in plugin or upload directories. Regular review of access logs and implementation of least-privilege principles for administrative accounts can further reduce risk. Organizations should also ensure that backups are current and tested, and that incident response plans are updated to address potential webshell or RCE scenarios.
References
The following resources provide further technical details and guidance:
The Hacker News: New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
Security Affairs: Attackers Can Take Over WordPress Sites Using Newly Released wp2shell Exploits
TechEchelon: WordPress "wp2shell" RCE Vulnerabilities Draw Active Exploitation as Public Exploits Circulate
WordPress Security Advisory: WordPress 7.0.2 Security Release
Cloudflare WAF Announcement: Cloudflare Blog
GitHub PoC Search: wp2shell
MITRE ATT&CK Framework: MITRE ATT&CK
About Rescana
Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to continuously monitor, assess, and mitigate cyber risks across their digital supply chain. Our advanced threat intelligence and automation capabilities empower security teams to proactively identify vulnerabilities, respond to emerging threats, and ensure compliance with industry standards. For more information about how Rescana can help safeguard your organization, or for any questions regarding this advisory, please contact us at info@rescana.com.
