wp2shell: Exploit Chaining for Unauthenticated RCE in WordPress
A WordPress Core vulnerability chain, publicly nicknamed wp2shell, combines CVE-2026-63030 (CVSS 9.8) and CVE-2026-60137 (CVSS 5.9) for pre-authentication remote code execution (RCE). The exploit chain affects WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2. WordPress 6.8.x before 6.8.6 is affected by CVE-2026-60137 alone. Dozens of proof-of-concept (PoC) exploits have been published for the full exploit chain [1] as well as several detailed technical write ups. In-the-wild exploitation was first widely reported by cyber security firms. Finally both CVEs were added to CISA’s KEV list on July 21st, 2026 [2][3]. Numerous national CERT agencies have issued alerts globally [4][5][6][7][8][9][10][11][12][13][14][15][16][17]. Because WordPress has an estimated 500 million installations globally, wp2shell presents a high degree of risk.
Greenbone’s OPENVAS ENTERPRISE FEED includes remote banner version checks to identify CVE-2026-63030 and CVE-2026-60137 for Linux [1][2] and Windows [3][4]. Grabbing a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED is a surefire way to gain the deepest insight into where software vulnerabilities exist in your organization’s IT infrastructure.
A Global Risk Assessment of wp2shell Affecting WordPress Core
The exposure is significant because the flaws impact default installations of WordPress Core rather than optional extensions or configurations and allows an unauthenticated attacker to achieve RCE. Searchlight Cyber estimates that more than 500 million websites use WordPress. Additional risk signals include widespread reports of active exploitation and numerous public PoCs.
A Summary of Active wp2shell Exploitation Campaigns
Active exploitation of CVE-2026-60137 and CVE-2026-63030 is now widely reported by numerous cyber security firms and independent sensor operators. Patchstack first classified both vulnerabilities as actively exploited shortly after disclosure [1]. Wordfence recorded probing of the WordPress REST API on July 17th, 2026, followed by a clear SQL-injection attempt 13 minutes later [2]. Several other cyber security companies have also confirmed active exploitation [3][4].
The observed campaigns are opportunistic, targeting WordPress installations across all industries and geographic regions. However, the activity has not been attributed to established threat actors, and no victims have been publicly identified. Confirmed techniques include unauthorized administrator-account creation, malicious-plugin installation, persistent backdoors and web shells, user enumeration, and attempts to obtain database credentials, authentication keys, and other secrets from wp-config.php.
Technical Details for CVE-2026-60137 and CVE-2026-63030
Here are brief details for both vulnerabilities in the wp2shell exploit chain:
- CVE-2026-63030 (CVSS 9.8): The WordPress Core batch API allows multiple REST calls to be bundled into one request. CVE-2026-63030 is a batch endpoint route confusion issue [CWE-436] associated with /wp-json/batch/v1. The flaw is caused when failed batch sub-requests are not appended to the $matches array resulting in an index offset. The flaw allows an attacker to submit a malicious batch of requests that includes a flawed low-privilege request designed to create an array index offset, followed by a high-privilege request that will be executed without proper authorization. By exploiting CVE-2026-63030, an attacker can not only bypass authorization, but also bypass other WordPress internal checks such as request method, route, and validation schema.
- CVE-2026-60137 (CVSS 5.9): An SQL-injection flaw caused by improper sanitization [CWE-89] of the author_exclude parameter in WP_Query. WordPress’s posts handler maps the attacker-controlled author_exclude value to the WP_Query::author__not_in parameter, which is only sanitized if provided as an integer array. When facilitated by CVE-2026-63030, attackers can provide malformed request parameters including a string type author_exclude value. The unsanitized value is then injected into an SQL query, where it can execute malicious SQL code.
How the wp2shell Unauthenticated RCE Chain Works
wp2shell is described as an exploit chain that combines CVE-2026-60137 and CVE-2026-63030. In the first stage, CVE-2026-63030 is leveraged to create a REST API batch endpoint route confusion flaw [CWE-436] in WordPress Core to execute unauthenticated commands. In the second stage, that condition is combined with the SQL-injection flaw [CWE-89] tracked as CVE-2026-60137 to further impact target WordPress installations.
Here is a general description of the wp2shell attack flow:
1. Exploit CVE-2026-63030
- The attacker submits a malicious request to WordPress’s public /wp-json/batch/v1 endpoint. The malformed subrequest triggers a request handler mismatch allowing privileged requests to be executed without proper authorization.
- The attacker recursively invokes the vulnerable batch endpoint. An initial desynchronization exploit bypasses authorization, while a second desynchronization exploit bypasses parameter validation. This allows a normally unsupported GET request to reach the WordPress posts handler with unvalidated input.
2. Exploit CVE-2026-60137
- The posts handler maps the attacker-controlled author_exclude value to WP_Query::author__not_in. WordPress sanitizes this value when it is provided as an array but not when it arrives as a string, allowing the value to be injected directly into an SQL query. The attacker may use a blind or UNION SELECT SQL-injection attack to recover sensitive information that can be used for further exploitation. This information includes enumerating the WordPress table prefix, an administrator user ID, existing post IDs, and generated oEmbed-cache row IDs.
- A UNION SELECT SQL injection can be designed to create legitimate WP_Post objects which are stored in the WordPress object cache. These objects form a chain of legitimate WordPress behaviors that convert the read-oriented SQL injection into database writes and application control-flow changes. Exploitation can allow an attacker to create rogue posts with web shells to achieve RCE with the privileges of the web-server process.
- Other attack scenarios include creating persistent rogue administrator accounts and using them to upload malicious plugins, theme components, or web shells to achieve RCE with the privileges of the web-server process.
The two CVEs chained in the wp2shell exploit, CVE-2026-63030 and CVE-2026-60137, each shown with its CVSS severity band and EPSS exploitation-probability score
A batch endpoint route confusion flaw [CWE-436] in the WordPress Core batch API (/wp-json/batch/v1), caused when failed sub-requests are not appended to the $matches array. An unauthenticated attacker can chain a malformed low-privilege request with a high-privilege one to bypass authorization and other internal validation checks.
An SQL-injection flaw [CWE-89] caused by improper sanitization of the author_exclude parameter, which WordPress maps to WP_Query::author__not_in but only sanitizes when passed as an integer array. A string-type value lets an attacker inject malicious SQL, and combined with CVE-2026-63030 this enables further exploitation.
Affected Versions and Mitigation for wp2shell
CVE-2026-60137 affects WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2. CVE-2026-63030 affects WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2. WordPress 6.8.x is only vulnerable to CVE-2026-60137, not the full wp2shell chain. The full wp2shell unauthenticated RCE vulnerability is only reported for WordPress Core versions 6.9.x and 7.0.x. That distinction is relevant for risk-based remediation, since exploiting CVE-2026-60137 depends on vulnerability to CVE-2026-63030.
The only described mitigation is to update WordPress Core to a fixed release. Users should update affected systems to 6.8.6, 6.9.5, or 7.0.2 as applicable. Greenbone’s OPENVAS ENTERPRISE FEED includes remote banner version checks to identify CVE-2026-63030 and CVE-2026-60137 for Linux [1][2] and Windows [3][4].
Summary
wp2shell is an unauthenticated RCE chain against WordPress Core that combines CVE-2026-63030 with CVE-2026-60137. Risk is amplified by widespread reports of exploitation. Defenders should immediately identify vulnerable WordPress installations and update them to the fixed versions described above.
Greenbone’s OPENVAS ENTERPRISE FEED includes remote banner version checks to identify CVE-2026-63030 and CVE-2026-60137 for Linux [1][2] and Windows [3][4]. Grabbing a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED is a surefire way to gain the deepest insight into where software vulnerabilities exist in your organization’s IT infrastructure.
Joseph has had a varied and passionate background in IT and cyber security since the late 1980s. His early technical experience included working on an IBM PS/2, assembling PCs and programming in C++.
He also pursued academic studies in computer and systems engineering, anthropology and an MBA in technology forecasting.
Joseph has worked in data analytics, software development and, in particular, enterprise IT security. He specialises in vulnerability management, encryption and penetration testing.
