Executive Summary
A critical vulnerability chain, known as wp2shell, has been identified in WordPress Core, enabling unauthenticated attackers to execute arbitrary code remotely on default installations without the need for any plugins. This vulnerability is tracked as CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection). Exploitation is achievable via a single anonymous HTTP request, and a public proof-of-concept (PoC) is available. All organizations operating affected WordPress versions are urged to update immediately to mitigate the risk of compromise.
Technical Information
The wp2shell vulnerability chain leverages two distinct flaws in WordPress Core. The first, CVE-2026-63030, is a logic error in the /wp-json/batch/v1 REST API endpoint, which mishandles parallel arrays during batch processing. This misalignment allows an attacker’s input to bypass endpoint allow-lists. The second, CVE-2026-60137, is a SQL injection vulnerability in the author__not_in parameter of the WP_Query class. When this parameter is supplied as a string rather than an array, it is injected directly into the SQL query, enabling arbitrary SQL execution.
The attack chain unfolds as follows: an attacker crafts a malicious request to the /wp-json/batch/v1 endpoint, exploiting the batch handler’s logic flaw to pass unsanitized input to the vulnerable author__not_in parameter. This input is then executed as part of a SQL query, and by chaining these vulnerabilities, the attacker achieves remote code execution (RCE) without authentication or the presence of plugins. The exploit is effective against default WordPress installations, significantly broadening the attack surface.
Affected versions include WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 for the full RCE chain, with fixes provided in 6.9.5 and 7.0.2 respectively. WordPress 7.1 beta is also vulnerable, with remediation in 7.1 beta2. Versions 6.8.0 through 6.8.5 are susceptible to the SQL injection component but not the full RCE chain, and are fixed in 6.8.6. Versions prior to 6.8 are not affected.
The exploit requires no user interaction or authentication, and works on default installations. Sites utilizing persistent object caches such as Redis or Memcached may not be vulnerable to the full RCE chain, but remain susceptible to SQL injection.
Exploitation in the Wild
A public PoC for wp2shell is available on GitHub, and both security researchers and threat actors are actively scanning for vulnerable endpoints, specifically /wp-json/batch/v1. As of July 18, 2026, there have been no confirmed reports of mass exploitation, but the risk is considered extremely high due to the simplicity of the attack and the availability of exploit code. It is important to note that neither CVE-2026-63030 nor CVE-2026-60137 are currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, so there is no CISA-confirmed active exploitation at this time.
APT Groups using this vulnerability
There is currently no public attribution of this vulnerability to any specific Advanced Persistent Threat (APT) groups. However, the ease of exploitation and the availability of a public PoC make it highly likely that cybercriminal groups will attempt mass exploitation. Historical precedent shows that similar WordPress vulnerabilities have been leveraged by groups such as WP-SHELLSTORM, which previously compromised thousands of sites using less severe flaws. Organizations should remain vigilant for opportunistic attacks from both organized cybercriminals and potential APT actors as the situation evolves.
Affected Product Versions
The following WordPress versions are affected by the wp2shell vulnerability chain: WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to the full RCE chain, with fixes in 6.9.5 and 7.0.2. WordPress 7.1 beta is vulnerable, fixed in 7.1 beta2. WordPress 6.8.0 through 6.8.5 are vulnerable to the SQL injection component only, with remediation in 6.8.6. Versions prior to 6.8 are not affected by either vulnerability.
Workaround and Mitigation
Immediate mitigation requires updating WordPress Core to version 6.9.5, 7.0.2, or 7.1 beta2 (or the latest available). Administrators should verify that the update has been successfully applied by checking the version in the WordPress dashboard, as auto-updates may not always complete as expected.
If immediate updating is not feasible, temporary mitigations include blocking unauthenticated access to the /wp-json/batch/v1 endpoint and requests containing rest_route=/batch/v1 at the web application firewall (WAF) or reverse proxy. Alternatively, administrators can use a plugin to disable unauthenticated REST API access, or deploy the drop-in plugin from Searchlight Cyber to reject anonymous /batch/v1 requests at the rest_pre_dispatch hook. These mitigations may disrupt legitimate integrations and should be considered temporary measures only.
For detection, organizations should monitor server logs for access to /wp-json/batch/v1, scrutinize for anomalous SQL queries involving the author__not_in parameter, and utilize vulnerability scanners such as Rapid7 InsightVM or Nexpose with updated signatures for CVE-2026-63030.
Indicators of Compromise
The following indicators are provided as a point-in-time reference and should be validated before enforcement, as threat actor infrastructure and tactics may change rapidly.
Type | Indicator | Reported (date) | Source
|
Domain | wp2shell[.]com | 2026-07-18 |
No additional public indicators of compromise were available at the time of writing.
References
Aikido Security Blog: Unauthenticated RCE in WordPress core (wp2shell), Rapid7 Labs: CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core, The Hacker News: New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code, Reddit: WordPress Core Flaw wp2shell Allows Unauthenticated Remote Code Execution, Cloudflare: WAF rules for WordPress vulnerabilities, GitHub PoC (search "wp2shell" exploit), Searchlight Cyber checker
Rescana is here for you
Rescana provides a comprehensive Third-Party Risk Management (TPRM) platform, empowering organizations to continuously monitor, assess, and mitigate cyber risks across their digital supply chain. Our platform delivers actionable intelligence and automated workflows to help you stay ahead of emerging threats. We are happy to answer any questions at info@rescana.com.
