New wp2shell Exploit Enables Full Takeover of WordPress Sites

Key Takeaways

• Two critical WordPress flaws (CVE‑2026-63030 and CVE‑2026-60137) can be chained to achieve pre‑authentication remote code execution on default installations of WordPress 6.9.x and 7.0.x.
• The exploits, collectively named wp2shell, require no valid credentials and work on a stock WordPress site with no plugins installed.
• WordPress has released version 7.0.2 (and the legacy 6.9.5) that patches both vulnerabilities; forced automatic updates have been enabled for affected supported versions.
• Over 500 million websites run WordPress, making the potential impact of the wp2shell attack chain exceptionally large.
• If immediate patching is not possible, administrators should block anonymous access to the REST API batch endpoint (/wp-json/batch/v1 or ?rest_route=/batch/v1) via a security plugin or WAF rule, though this is only a temporary measure.
• Searchlight Cyber provides an online checker to help site owners verify whether their instance is vulnerable.

Overview of the wp2shell Vulnerabilities
Security researchers at Searchlight Cyber disclosed a pair of critical vulnerabilities in WordPress Core that, when combined, allow unauthenticated attackers to obtain remote code execution. The flaws are tracked as CVE‑2026-63030, a REST API batch‑route confusion bug introduced in WordPress 6.9, and CVE‑2026-60137, a high‑severity SQL injection in the author__not_in parameter of WP_Query. By chaining these issues, an attacker can bypass authentication, inject malicious SQL, and ultimately execute arbitrary PHP code on the server. The attack works on a default WordPress installation with no additional plugins, making it particularly dangerous for the vast majority of sites.

Details of CVE‑2026-63030
CVE‑2026-63030 stems from a logic error in the way WordPress handles batch requests sent to the REST API endpoint /wp-json/batch/v1. When a specially crafted batch request is submitted, the API incorrectly merges routes, allowing an attacker to invoke privileged actions without providing valid nonce tokens or user credentials. This confusion can be leveraged to trigger actions that would normally require administrator privileges, such as updating options or injecting code into the database. The vulnerability was introduced with the batch‑API enhancements in WordPress 6.9 and persists through version 6.9.4.

Details of CVE‑2026-60137
CVE‑2026-60137 is a SQL injection vulnerability located in the author__not_in argument of the WP_Query class, which is used to filter posts by excluding specific authors. Due to insufficient input sanitization, an attacker can inject arbitrary SQL syntax through this parameter when it is processed via the REST API batch route. The injection can be used to extract, modify, or delete data from the WordPress database, and—when combined with the batch‑route confusion—enables the execution of arbitrary PHP code stored in the database (e.g., via a crafted post content). The flaw affects WordPress 7.0.0 through 7.0.1 and is classified as high severity.

Impact and Scope
Because the exploit chain requires no authentication, any anonymous internet user can target a vulnerable WordPress site. Researchers estimate that over 500 million websites run WordPress, meaning a substantial portion of the web is potentially exposed. Successful exploitation grants the attacker full control over the server environment, permitting actions such as installing backdoors, defacing pages, stealing sensitive data, or using the compromised host for further attacks (e.g., distributing malware or launching DDoS campaigns). The severity prompted WordPress to label the issue as critical and to issue an urgent security release.

WordPress Response and Forced Updates
In response to the disclosure, WordPress published version 7.0.2 (and the legacy maintenance release 6.9.5) that patches both CVE‑2026-63030 and CVE‑2026-60137. The announcement emphasized that, due to the severity, the WordPress.org team has activated forced automatic updates for all sites running the affected versions. This mechanism ensures that even administrators who have disabled manual updates will receive the security patches without further action, reducing the window of exposure. Site owners are urged to verify that their installations have been upgraded to at least 7.0.2 or 6.9.5.

Mitigation Guidance for Unpatched Environments
If immediate updating is not feasible—for example, due to compatibility concerns with custom code—administrators can apply temporary mitigations. Blocking anonymous access to the REST API batch endpoint (/wp-json/batch/v1 and the query string variant ?rest_route=/batch/v1) through a web application firewall (WAF) rule or a security plugin (such as Wordfence, Sucuri, or iThemes Security) can prevent the initial batch‑route confusion from being exploited. However, Searchlight Cyber cautions that such blocks may interfere with legitimate functionality that relies on batch requests, such as certain plugins or theme features, and therefore should be considered only a stop‑gap measure until a proper update can be applied.

Recommendations for Administrators

1. Update Immediately – Upgrade to WordPress 7.0.2 (or 6.9.5 for sites still on the 6.9 line) as soon as possible.
2. Verify Update Status – Use the online vulnerability checker released by Searchlight Cyber or the built‑in Site Health tool to confirm that the patches are applied.
3. Review Logs – Examine access and error logs for unusual batch‑API requests or SQL‑error patterns that may indicate exploitation attempts.
4. Implement WAF Rules – If updating is delayed, deploy restrictive WAF rules targeting the batch endpoint while monitoring for false positives.
5. Maintain Regular Backups – Ensure recent, tested backups are available to facilitate rapid recovery in case of compromise.
6. Stay Informed – Subscribe to WordPress security mailing lists and follow trusted security researchers for future vulnerability announcements.

Conclusion
The wp2shell exploit chain underscores how seemingly modest flaws in widely used platforms can combine to produce devastating pre‑authentication remote code execution. With over half a billion WordPress sites potentially at risk, the rapid release of patches and the enforcement of automatic updates are critical steps in defending the ecosystem. Administrators should prioritize updating, verify the success of those updates, and employ temporary network‑level controls only when absolutely necessary. By adhering to these best practices, the WordPress community can mitigate the immediate threat and maintain resilience against similar future vulnerabilities.