WordPress Core Exploit Chain WP2Shell In the Wild: REST API Route Confusion + SQLi to RCE
FortiGuard issued an outbreak alert: WordPress core CVE-2026-63030 and CVE-2026-60137 chained in the wild. Unauthenticated attackers can bypass REST API restrictions, inject SQL, and reach arbitrary code execution. Versions 6.8.0 through 7.0.1 affected.
Fortinet FortiGuard Labs issued an Outbreak Alert: WordPress core carries an exploit chain named WP2Shell, combining CVE-2026-63030 (REST API route confusion) and CVE-2026-60137 (SQL injection). Unauthenticated attackers can reach arbitrary code execution on affected sites. Exploitation attempts already observed in the wild. Sites running WordPress 6.8.0 through 7.0.1 must upgrade immediately.
Incident Overview
Officially confirmed ranges:
- CVE-2026-63030: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1
- CVE-2026-60137: 6.8.0–6.8.5, 6.9.0–6.9.4, 7.0.0–7.0.1
Fixed in 6.8.6, 6.9.5, and 7.0.2. FortiGuard classified the chain as outbreak-level: exploitation volume warrants a global alert.
Technical Details
CVE-2026-63030 is REST API route confusion: an unauthenticated remote attacker can bypass intended endpoint access controls and invoke protected API functionality. It does not execute code by itself; it opens the path. CVE-2026-60137 is SQL injection: arbitrary SQL queries, data theft or tampering. Chained, the attacker first reaches a restricted endpoint via route confusion, then uses SQLi to achieve arbitrary code execution at the database and server layers—unauthenticated access to WebShell drop. Suricata signatures 2071233/2071234 cover the exploit traffic.
Impact Assessment
WordPress powers more than 40% of sites worldwide. A weaponized core chain implies mass scanning of the installed base. After takeover: backdoors, malicious script injection, SEO hijack, or further server compromise. Being one minor version behind core is enough to be a target.
Remediation
- Upgrade WordPress immediately to 6.8.6, 6.9.5, or 7.0.2+.
- After upgrade, check site integrity: core file hashes, suspicious PHP in themes/plugins, newly created admin accounts.
- Temporary mitigation: WAF blocks on anomalous bulk REST API requests; restrict unconventional calls to
wp/v2routes. - Detection: Suricata 2071233/2071234, or web logs showing anomalous REST API route combinations plus SQLi-style parameters.
Sources
- Fortinet FortiGuard Outbreak Alert: WP2Shell RCE
- CVE-2026-63030 details