wp2shell: What You Need to Know About the Critical WordPress RCE Vulnerability

Identifiers

The wp2shell attack is a two-vulnerability chain :

• CVE-2026-63030 — A REST API batch-endpoint route confusion issue. Critically rated, with a CVSS score of 9.8 . (Initial reports from one source listed 7.5, but multiple security vendors revised it to 9.8 .)
• CVE-2026-60137 — An unauthenticated SQL injection in the author__not_in parameter of WP_Query. Rated high severity .

Affected Versions

• WordPress 6.9.x: All versions before 6.9.5 (6.9.0 through 6.9.4)
• WordPress 7.0.x: All versions before 7.0.2 (7.0.0 and 7.0.1)
• Older branch 6.8.x: Received a backport to 6.8.6

Technical Details

The wp2shell attack chains two bugs :

1. CVE-2026-60137 is an unauthenticated SQL injection. By sending crafted HTTP requests to the author__not_in parameter, an attacker can inject malicious SQL into the WordPress database without any login credentials.

2. CVE-2026-63030 is a route confusion flaw in the REST API batch endpoint (/wp-json/batch/v1). This endpoint processes multiple sub-requests in a single call. A parsing quirk causes two internal arrays to go out of step, allowing an attacker to bypass route restrictions and chain internal API calls that would normally be disallowed .

When combined, an attacker uses the batch endpoint to make nested requests that abuse the SQL injection. This escalates to full remote code execution by:

• Writing arbitrary data (like a PHP webshell) into the filesystem via MySQL's INTO OUTFILE command, or
• Manipulating WordPress options that execute PHP .

The attack requires no authentication, no plugins, and works on a default WordPress installation . As of July 18, 2026, a public proof-of-concept checker was released at wp2shell.com, and a working PoC exploit is circulating .

One important nuance: a persistent object cache (such as Redis or Memcached) may partially mitigate or change the exploit path, but it does not eliminate the underlying vulnerability .

Mitigation Steps

1. Update immediately — Upgrade to WordPress 6.9.5, 7.0.2, or 6.8.6. Most sites with auto-updates enabled should have received the forced update already .
2. Verify your version — Go to Dashboard → Updates or check wp-includes/version.php.
3. If you cannot update right away, deploy a virtual patch or WAF rule. Cloudflare released WAF rules specifically blocking the wp2shell attack vector .
4. Check for indicators of compromise — Look for unexpected files in wp-content/uploads/, unfamiliar admin users, or unusual database entries. Although no mass exploitation has been confirmed, the public PoC means scanning has likely started.
5. Review database user privileges — Ensure the WordPress database user does not have the FILE privilege (which enables INTO OUTFILE). This limits the RCE escalation path.

Why the Open-Source Nature of WordPress Poses an Acute Risk

Even with no confirmed exploitation in the wild, the open-source model introduced a distinctive, acute risk for wp2shell:

• Full source code transparency for attackers — Because WordPress is open source, anyone can download the patched versions, diff the code against the vulnerable versions, and reverse-engineer the exact exploit path within hours of the patch release. Security vendors confirmed that source-code diffing immediately reveals the vulnerable code .
• Shortened window for defenders — Unlike proprietary software where exploit development requires independent vulnerability research, an open-source patch effectively publishes the vulnerability details. Defenders must patch globally within hours, not days.
• Massive, diverse attack surface — WordPress powers roughly 43% of all websites. Millions of installations are run by operators with varying security maturity. Many sites are neglected, on outdated PHP versions, or lack automatic updates, becoming easy targets once exploit code is public .
• Low barrier to weaponization — The PoC checker and exploit code were published within 24 hours of the patch . Any moderately skilled attacker can adapt the public code into a mass-scanning weapon.
• No authentication barrier — The entire chain is pre-authentication and works against stock WordPress. An attacker does not need valid credentials, a vulnerable plugin, or any special configuration. This dramatically lowers the effort needed to weaponize the vulnerability at scale .

In short, the open-source model means the patch itself becomes the detailed disclosure document, and the massive, variable-quality install base guarantees a long tail of vulnerable targets — creating a high-risk period even before any "official" exploitation is observed.