Key Takeaways
- Two critical, unauthenticated flaws in WordPress Core—CVE‑2026-63030 (REST API batch‑route confusion) and CVE‑2026-60137 (SQL injection in WP_Query)—can be chained to achieve pre‑authentication remote code execution.
- The combined exploit, dubbed wp2shell, affects WordPress versions 6.9.0‑6.9.4 and 7.0.0‑7.0.1; the SQL‑injection flaw alone also impacts 6.8.0‑6.8.5 but cannot lead to RCE without the batch‑route bug.
- WordPress has issued forced automatic security updates; administrators should upgrade immediately to WordPress 6.9.5 or 7.0.2.
- Temporary mitigations include blocking anonymous REST‑API access via a plugin or WAF rules for
/wp-json/batch/v1and?rest_route=/batch/v1, but these are not substitutes for patching. - Cloudflare has deployed WAF protections for both vulnerabilities across all plans, yet stresses that patching remains essential.
- Public proof‑of‑concept exploits are now available, and early signs of in‑the‑wild exploitation have been observed, underscoring the urgency of updating.
Overview of the wp2shell Vulnerability
The wp2shell vulnerability represents a severe security issue in WordPress Core that allows an unauthenticated attacker to execute arbitrary code on a target site without needing any credentials. Discovered by Adam Kues of Searchlight Cyber, the flaw consists of two independent bugs that, when combined, form a reliable remote‑code‑execution (RCE) chain. Because the attack works against a default WordPress installation with no plugins enabled, the potential impact is enormous—Searchlight Cyber estimates that more than 500 million websites run WordPress, making this one of the most widely threatening vulnerabilities disclosed in recent years. The release of public proof‑of‑concept (PoC) code has heightened the risk, prompting WordPress to enable forced automatic updates for affected installations.
Details of CVE‑2026-63030 (REST API batch‑route confusion)
CVE‑2026-63030 is a REST API batch‑route confusion vulnerability that was introduced in WordPress 6.9. The bug resides in the way the /wp-json/batch/v1 endpoint processes batch requests, allowing an attacker to manipulate routing logic and gain unauthorized access to internal API functions. By crafting a specially formatted batch request, an unauthenticated user can trigger the server to execute arbitrary code paths that are normally restricted to authenticated users. This confusion flaw alone does not lead to direct code execution, but it provides a critical foothold that can be leveraged when paired with an SQL injection vulnerability.
Details of CVE‑2026-60137 (SQL injection in WP_Query)
The second flaw, tracked as CVE‑2026-60137, is a high‑severity SQL injection present in the author__not_in parameter of the WP_Query class. This vulnerability affects WordPress versions 6.8.0 through 6.8.5, as well as the later 6.9.x and 7.0.x branches. An attacker can inject malicious SQL code via the parameter, which is then executed by the database layer when WordPress builds queries for posts, pages, or custom post types. While the SQL injection can be used to extract sensitive data such as password hashes, it does not, by itself, grant remote code execution. However, when combined with the batch‑route confusion bug, the injection outcome can be used to manipulate the REST API’s behavior and achieve full RCE.
How the Two Flaws Chain to Pre‑auth RCE
The wp2shell attack chain exploits the two vulnerabilities in sequence. First, the attacker uses the SQL injection (CVE‑2026-60137) to retrieve password hashes or other sensitive data from the WordPress database. With the hash in hand, they can either crack the password offline or, in some PoC variants, directly manipulate the query to inject a malicious payload that alters the site’s option values. Next, the REST API batch‑route confusion (CVE‑2026-63030) is abused to send a crafted batch request that tricks WordPress into treating the injected payload as a legitimate API call. This causes the server to execute arbitrary PHP code, effectively granting the attacker remote code execution without needing to authenticate. The chain works against a stock WordPress install, meaning no plugins or theme modifications are required for the exploit to succeed.
Affected WordPress Versions
According to the official WordPress advisories, the complete RCE chain impacts WordPress 6.9.0 through 6.9.4 and WordPress 7.0.0 through 7.0.1. The standalone SQL injection flaw (CVE‑2026-60137) also affects older releases from 6.8.0 to 6.8.5, but because the batch‑route confusion bug was only added in WordPress 6.9, those earlier versions cannot be chained to achieve RCE. The vulnerabilities have been patched in the maintenance releases WordPress 6.9.5 and 7.0.2, which incorporate fixes for both CVE‑2026-63030 and CVE‑2026-60137.
Patch Recommendations and Forced Updates
In response to the critical nature of the wp2shell flaw, the WordPress security team has activated forced automatic security updates for all sites running the affected versions. Administrators are strongly urged to verify that their installations have been upgraded to WordPress 6.9.5 (for the 6.9.x line) or 7.0.2 (for the 7.0.x line). WordPress’s official announcement emphasizes that, because this is a security release, immediate updating is the best defense. Sites that have automatic updates disabled should apply the patches manually via the dashboard or through WP‑CLI as soon as possible.
Mitigation Strategies for Immediate Protection
For organizations that cannot apply the updates instantly—for example, due to compatibility testing or scheduled maintenance windows—Searchlight Cyber suggests two temporary mitigations. First, install a reputable security plugin that blocks anonymous access to the REST API entirely, preventing unauthenticated users from reaching the vulnerable batch endpoint. Second, configure a web‑application firewall (WAF) to drop requests targeting the specific paths /wp-json/batch/v1 and any query string containing ?rest_route=/batch/v1. These measures reduce the attack surface but are explicitly labeled as stop‑gap solutions; they do not replace the need for upgrading to the patched WordPress versions.
Cloudflare WAF Protections
Cloudflare has rolled out WAF rules designed to thwart exploitation of both CVE‑2026-60137 and CVE‑2026-63030 across all of its plans, including the free tier, for traffic proxied through its network. The rules inspect incoming requests for signatures matching the known SQL injection patterns and the anomalous batch‑route confusion attempts, blocking them before they reach the origin server. While Cloudflare stresses that these protections lower the risk while administrators patch, they caution that reliance solely on WAF filtering is insufficient; the underlying software must still be updated to eliminate the vulnerability completely.
Public Proof‑of‑Concept Exploits and Observed In‑the‑Wild Activity
Although Searchlight Cyber initially withheld technical details to give administrators a window to patch, multiple public PoC exploits have since appeared on GitHub. Some of these PoCs demonstrate a two‑stage attack: first extracting WordPress password hashes via the SQL injection, then cracking an administrator password, uploading a malicious plugin, and executing arbitrary commands. Other variants claim to achieve pre‑authentication RCE without needing any credentials, aligning with Searchlight’s original description. Security firm watchTowr has reported observing the circulation of these exploits and has already detected the first signs of in‑the‑wild exploitation, indicating that attackers are actively attempting to leverage the vulnerability in real‑world environments.
Guidance for Administrators and Conclusion
Given the availability of functional exploit code and early evidence of live attacks, WordPress site owners must treat the wp2shell vulnerability as an urgent priority. The recommended course of action is to verify that every WordPress instance under their control is running either version 6.9.5 or 7.0.2, applying the update immediately if not already done. If immediate patching is not feasible, deploy the temporary mitigations—REST‑API blocking via a plugin or WAF rules—as an interim safeguard, but schedule a permanent upgrade at the earliest opportunity. Additionally, monitoring logs for abnormal REST‑API requests or unexpected database errors can help detect attempted exploitation. By combining prompt patching, temporary defensive measures, and vigilant monitoring, administrators can effectively neutralize the threat posed by the wp2shell RCE chain and protect their sites from potential compromise.