wp2shell WordPress Vulnerability: CVE-2026-63030 Explained

What Is the wp2shell WordPress Vulnerability?

On July 17, 2026, researchers disclosed the wp2shell WordPress vulnerability, a chain of two flaws that lets an unauthenticated attacker execute remote code against WordPress Core installations. Consequently, the security community tracks this chain under two identifiers: CVE-2026-60137 (critical SQL injection) and CVE-2026-63030 (high-severity REST API batch endpoint route confusion). Since then, moreover, CISA has added both to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation.

Suggested image: a simple flow diagram showing “REST API batch request → route confusion → SQL injection → remote code execution.” Alt text: “wp2shell WordPress vulnerability CVE-2026-63030 attack chain diagram.”

CVE-2026-63030: WordPress REST API Batch Endpoint Vulnerability

First, this WordPress REST API batch endpoint vulnerability targets WP_REST_Server::serve_batch_request_v1(). Accordingly, researchers classify it as CWE-436 (interpretation conflict) and rate it 7.5 (High) on the CVSS v3.1 scale. Furthermore, because the affected endpoint, /wp-json/batch/v1, has shipped with WordPress since version 5.6, the vulnerable code reaches a large installed base. However, some scanning vendors report a higher combined-severity score of 9.8 when they score this CVE as part of the full wp2shell WordPress vulnerability chain rather than as the standalone route-confusion issue; even so, the underlying advisory still treats 7.5 as the rating for that standalone component.

Affected versions: WordPress versions 6.9.0 through 6.9.4 and versions 7.0.0 through 7.0.1.

Fixed in: Versions 6.9.5 and 7.0.2, which WordPress released on July 17, 2026.

CVE-2026-60137: WordPress SQL Injection Vulnerability

Meanwhile, this WordPress SQL injection vulnerability lives in the author__not_in parameter of WP_Query. As a result, researchers classify it as CWE-89 and rate it 9.1 (Critical) on the CVSS v3.1 scale, since it sits in the core class that builds most of the database queries WordPress issues.

Affected versions: WordPress 6.8.0 through 6.8.5, 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1.

Fixed in: Versions 6.8.6, 6.9.5, and 7.0.2.

How the WordPress Unauthenticated RCE Chain Works

On their own, each flaw stays fairly contained. For instance, the route confusion alone remains a bounded problem, and, similarly, the SQL injection normally requires authentication before an attacker can trigger it. Together, though, they produce the WordPress unauthenticated RCE that defines wp2shell: indeed, early researchers found that CVE-2026-63030 functions as a de facto auth bypass, unblocking the authenticated SQL injection so that an attacker could then dump the target database and pivot to code execution. As a result, an unauthenticated attacker can execute code via the WordPress REST API batch endpoint, with no valid account or user interaction required, and potentially achieve complete compromise of the website and its underlying data.

This distinction also affects patch prioritization. Specifically, version 6.8.x carries the SQL injection component but does not appear on the list of branches vulnerable to the full RCE chain, since the route confusion introduced in 6.9 supplies the unauthenticated path. Consequently, a scan that checks only for CVE-2026-63030 may miss 6.8.x exposure to the SQL injection itself.

Is This WordPress RCE Vulnerability Being Exploited?

At disclosure, no evidence of exploitation existed. Since then, however, reports of in-the-wild activity have emerged, and VulnCheck Canaries observed active exploitation beginning July 20. In fact, by the early hours of the following Saturday (UTC), successful exploitation was already well underway, and within three days of disclosure, attackers were widely chaining the two vulnerabilities to attack one of the largest surfaces on the internet. Meanwhile, reports indicate hackers are deploying persistent webshells and installing malicious plugins on affected servers.

Who Discovered the wp2shell WordPress Vulnerability

To begin with, Adam Kues of Assetnote, the attack surface management arm of Searchlight Cyber, discovered the vulnerability and responsibly disclosed it through WordPress’s HackerOne program. Because, however, the researchers described the attack as having no preconditions and being exploitable by an anonymous user against a stock install, they withheld full technical details to give defenders time to patch.

How to Patch This WordPress Core Security Vulnerability

Given the severity, therefore, organizations operating affected WordPress installations should prioritize upgrading immediately, since applying the WordPress-provided update remains the most effective way to remediate CVE-2026-63030. Fortunately, WordPress has already taken steps to help: maintainers stated they are forcing updates for affected installations with automatic updates enabled. Even so, administrators should still verify that each internet-facing WordPress website has successfully upgraded, since workarounds are not recommended at this time.

If you need help confirming whether the wp2shell WordPress vulnerability has already been leveraged against your site, or needs assistance applying and validating the patch, contact our support team for a review.

References