WordPress Core Pre-Auth RCE Chain Alert: wp2shell (CVE-2026-63030/60137) Under Active Exploitation

WordPress core pre-auth RCE chain wp2shell combines CVE-2026-63030 (REST API route confusion, CVSS 9.8) and CVE-2026-60137 (SQL injection). In-the-wild exploitation is confirmed.

Incident overview

On 17 July 2026, WordPress shipped a security update for a critical chain researchers named wp2shell. First confirmed in-the-wild pre-auth RCE combination in WordPress core in nearly a decade. CVE-2026-63030 chained with CVE-2026-60137. No account. No plugin. Anonymous HTTP fully owns a default WordPress site.

Tenable Research Special Operations and Wordfence Intelligence confirmed public POC hours after disclosure. Multiple vendors confirmed active exploitation. WordPress.org enabled forced auto-updates on affected supported versions.

Technical details and attack vector

CVE-2026-63030: REST API Batch Route Confusion

CVSS v3.1 9.8 (Critical)

Vulnerability type REST API Batch Route Confusion

Introduced in WordPress 6.9

Auth required None

Bug lives in the REST API /wp-json/batch/v1 batch endpoint. WP_REST_Server::serve_batch_request_v1() keeps two parallel arrays: $matches (matched handlers) and $validation (validation results). When wp_parse_url() fails on a sub-request path, that sub-request is appended only to $validation, not $matches. Indexes desync. Later sub-requests get the wrong handlers and skip validation entirely.

CVE-2026-60137: WP_Query SQL Injection

CVSS v3.1 5.9 (Medium; Critical as a chain component)

Vulnerability type SQL Injection

Affected versions WordPress 6.8.0–6.8.5 (standalone SQLi); 6.9.x + 7.0.x (full RCE chain)

Injection point WP_Query author__not_in parameter

Nested batch requests smuggle GET parameters (e.g. author_exclude) inside inner POSTs. Those values hit WP_Query unfiltered and are concatenated into SQL. Boolean and time-based blind injection follows. Arbitrary DB reads, including admin password hashes.

Full attack chain

• Entry: CVE-2026-63030 route confusion bypasses REST API validation
• Injection: CVE-2026-60137 blind SQLi reads admin password hashes from wp_users
• Crack: offline crack of admin hashes (WordPress default phpass; weak passwords in minutes)
• Code execution: admin login, malicious PHP via plugin/theme upload, arbitrary code execution

Affected versions

• Full RCE chain: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1
• Standalone SQL injection: WordPress 6.8.0–6.8.5

Impact

WordPress is the most deployed open-source CMS, 500M+ sites. Practical risk is high:

• Zero prerequisites: default install, no plugins
• Fully anonymous: no account
• Mass automation: easy to fold into scanners and attack tooling
• Persistent control: admin leads to backdoor plugins, content tampering, further server compromise

Cloudflare: the vulnerable path fires when persistent object cache is unused. Default on most shared hosting and small VPS.

Remediation

Upgrade immediately

Patched releases are out. Upgrade now:

• WordPress 6.8.x → 6.8.6 or later
• WordPress 6.9.x → 6.9.5 or later
• WordPress 7.0.x → 7.0.2 or later

WordPress.org enabled forced auto-updates on affected versions. Still verify upgrade status manually.

Temporary mitigations (if you cannot upgrade immediately)

• Disable or restrict /wp-json/batch/v1 at the web server (Nginx/Apache)
• WAF rules blocking nested batch-request HTTP patterns
• Strong passwords and MFA on all admin accounts
• Watch wp_users for unexpected admin accounts
• Check wp-content/plugins for unknown plugins

Detection

• Scan with the Searchlight Cyber wp2shell.com checker
• Web server logs: high-volume anomalous POSTs to /wp-json/batch/v1
• Slow-query logs: anomalous author__not_in queries
• Audit last-modified times on installed plugins and themes

Sources

• Tenable: wp2shell WordPress core pre-auth RCE FAQ
• Tencent Financial Cloud: WordPress wp2shell RCE advisory
• Alibaba Cloud: WordPress wp2shell RCE risk advisory
• Wordfence Intelligence vulnerability database