Introduction

Security researchers have disclosed a critical vulnerability chain, collectively named wp2shell, affecting WordPress Core. Tracked as CVE-2026-63030 and CVE-2026-60137, the vulnerabilities can be chained to achieve pre-authentication Remote Code Execution (RCE) on vulnerable WordPress installations.

The vulnerabilities were discovered by Searchlight Cyber, which confirmed that the attack requires no authentication, no plugins, and no special configuration, making default WordPress installations susceptible. Since the disclosure, multiple public proof-of-concept (PoC) exploits have been published, and security researchers have confirmed active exploitation in the wild, significantly increasing the risk to organisations running affected versions.

Given WordPress powers over 500 million websites globally, this vulnerability chain represents one of the most severe WordPress Core security issues in recent years. Website administrators should immediately update to the latest patched versions to prevent compromise.

Vulnerability Summary

The wp2shell attack is not a single vulnerability but a combination of two independent security flaws that, when chained together, allow attackers to execute arbitrary code remotely without authentication.

Individually, each vulnerability presents a serious security risk. However, when combined, they enable attackers to gain pre-authentication Remote Code Execution, allowing complete compromise of vulnerable WordPress servers.

Successful exploitation may allow attackers to:

• Execute arbitrary system commands

• Install malicious plugins

• Deploy persistent webshells

• Create administrator accounts

• Steal WordPress password hashes

• Maintain long-term persistence

• Fully compromise the hosting environment

Detailed Analysis

CVE-2026-63030 – REST API Batch-Route Confusion

Introduced in WordPress 6.9, this vulnerability affects the WordPress REST API batch-processing endpoint.

The flaw allows specially crafted REST API requests to bypass expected routing behaviour. While this vulnerability alone does not directly result in remote code execution, it provides attackers with the ability to manipulate request processing in a way that enables further exploitation when combined with another vulnerability.

This flaw forms the first stage of the wp2shell exploit chain.

CVE-2026-60137 – SQL Injection in WP_Query

The second vulnerability is a SQL Injection affecting the author__not_in parameter within WordPress' WP_Query functionality.

Attackers can inject malicious SQL statements through crafted requests, potentially allowing them to:

• Extract sensitive database information

• Retrieve WordPress password hashes

• Enumerate administrative accounts

• Manipulate database queries

This vulnerability affects WordPress 6.8 and later. However, on versions 6.8.x, it cannot be chained into remote code execution because the REST API batch-route confusion vulnerability was introduced only in WordPress 6.9.

Exploitation Chain

The wp2shell attack combines both vulnerabilities into a powerful exploit chain:

1. The attacker sends a malicious request to the vulnerable REST API batch endpoint.

2. The routing confusion vulnerability bypasses expected request handling.

3. The SQL Injection vulnerability is leveraged to manipulate backend database queries.

4. The attacker gains the ability to execute arbitrary PHP code.

5. A malicious plugin or webshell is uploaded.

6. Persistent remote access to the server is established.

Because the attack occurs before authentication, attackers do not require valid WordPress credentials to compromise vulnerable systems.

Active Exploitation

Although Searchlight Cyber initially withheld technical details to allow administrators time to patch, multiple public PoC exploits have since been released on GitHub.

Security researchers have observed exploit variants capable of:

• Extracting WordPress password hashes

• Cracking administrator credentials

• Uploading malicious plugins

• Deploying persistent webshells

• Executing arbitrary commands remotely

Additionally, watchTowr has confirmed early signs of real-world exploitation, indicating threat actors have already begun targeting vulnerable WordPress installations shortly after public exploit code became available.

Affected Versions

Remote Code Execution Chain

The complete wp2shell exploit chain affects:

• WordPress 6.9.0 – 6.9.4

• WordPress 7.0.0 – 7.0.1

SQL Injection Only

The SQL Injection vulnerability (CVE-2026-60137) also affects:

• WordPress 6.8.0 – 6.8.5

Although vulnerable to SQL Injection, these versions are not susceptible to the full RCE chain because they do not contain the REST API batch-route confusion vulnerability.

Patched Versions

The vulnerabilities have been resolved in:

• WordPress 6.9.5

• WordPress 7.0.2

Mitigation Strategies

Due to the critical nature of the vulnerabilities, the WordPress Security Team has enabled forced automatic security updates for supported installations. Organisations should treat this vulnerability chain as a critical priority.

These controls reduce exposure but should only be considered temporary mitigations until systems can be fully patched.

Web Application Firewall Protection

Cloudflare has deployed WAF protections across all plans, including free accounts, to detect and block exploitation attempts targeting:

• CVE-2026-63030

• CVE-2026-60137

While WAF protections help reduce exposure, they do not eliminate the underlying vulnerability, making software updates essential.

Incident Response Recommendations

Organisations that suspect exploitation before patching should initiate a Digital Forensics and Incident Response (DFIR) process, including:

• Reviewing authentication logs.

• Identifying newly created administrator accounts.

• Detecting unauthorized plugin installations.

• Searching for webshells and malicious PHP files.

• Inspecting scheduled tasks and persistence mechanisms.

• Resetting administrator credentials if compromise is confirmed.

Conclusion

The wp2shell vulnerability chain represents a rare but highly critical flaw in WordPress Core, enabling unauthenticated attackers to gain remote code execution and deploy persistent webshells. With public exploit code readily available and active attacks already observed, organisations should prioritise patching affected systems, enable automatic updates, strengthen web application firewall protections, and conduct comprehensive forensic investigations if compromise is suspected.
Learn more about how BridgeLynk partners with you to improve organisational security maturity and risk reduction www.bridgelynk.com.