A critical ‘wp2shell’ remote code execution vulnerability has been disclosed for WordPress Core. It is crucial for website administrators to patch their sites immediately.
The wp2shell attack involves two vulnerabilities, identified as CVE-2026-63030 and CVE-2026-60137, which can be exploited together, allowing pre-authentication remote code execution on WordPress installations running versions 6.9.x and 7.0.x.
This vulnerability was uncovered by Searchlight Cyber’s Adam Kues, indicating that an unauthenticated attacker can exploit it on a standard WordPress installation.
Searchlight Cyber states, “Our security research team has identified a pre-authentication RCE in WordPress core,” outlined in their report.
“This attack has no prerequisites and can be executed by anonymous users on a standard WordPress installation without plugins.”
With over 500 million websites reportedly using WordPress, this vulnerability presents a significant risk, especially given the availability of a publicly disclosed proof-of-concept exploit.
In light of the severity of this vulnerability, the WordPress Security Team has activated mandatory automatic security updates for supported installations running affected versions. They urge site owners to update to WordPress 7.0.2 or 6.9.5 without delay.
“This is a security release, and immediate updates are recommended,” emphasized WordPress in their security announcement.
“The WordPress.org team has enforced an automatic update for sites that are running versions with the identified vulnerabilities.”
This issue encompasses two distinct vulnerabilities that can be combined to form an unauthenticated remote code execution chain.
The first is CVE-2026-63030, a REST API batch route confusion vulnerability introduced in WordPress 6.9. As detailed in a GitHub advisory, this vulnerability can potentially leverage an SQL injection vulnerability to achieve remote code execution.
The second vulnerability, CVE-2026-60137, is an SQL injection flaw affecting the author__not_in parameters of WP_Query. WordPress classifies this as a high-severity SQL injection issue impacting versions 6.8 and later.
According to WordPress advisories, the full remote code execution attack chain impacts WordPress versions 6.9.0 – 6.9.4 and 7.0.0 – 7.0.1.
The SQL injection vulnerability also affects versions 6.8.0 to 6.8.5 but cannot be chained to remote code execution due to the absence of the REST API batch route confusion bug in those releases.
The complete wp2shell attack chain has been patched in WordPress versions 6.9.5 and 7.0.2.
For now, Searchlight Cyber has opted to limit technical details to provide administrators time to implement patches. They recommend visiting wp2shell.com to assess their WordPress installations for vulnerabilities.
For organizations unable to update immediately, Searchlight Cyber suggests:
- Install a plugin that fully blocks anonymous access to the REST API, or
- Configure WAF rules to block
/wp-json/batch/v1and?rest_route=/batch/v1.
These measures should be considered temporary until the system undergoes updates.
Cloudflare has also announced the deployment of web application firewall (WAF) protection against both vulnerabilities across all account tiers, including free plans.
Cloudflare reports that the rule aims to block attempts to exploit both the SQL injection flaw (CVE-2026-60137) and the REST API batch route confusion vulnerability (CVE-2026-63030).
“Although WAF protection mitigates some risks, it is not a replacement for patching,” stated Cloudflare.
Public Proof-of-Concept Exploit Unveiled
Although Searchlight Cyber has delayed the release of comprehensive technical details to allow time for administrators to implement patches, several proof-of-concept exploits have emerged on GitHub.
Some of these publicly available exploits link the two vulnerabilities to extract WordPress password hashes via SQL injection, allowing attackers to crack administrator passwords, log in, and upload malicious plugins for command execution. Other proofs claim to facilitate pre-authenticated remote code execution without administrator credentials, aligning more closely with Searchlight Cyber’s findings.
BleepingComputer has confirmed with Searchlight Cyber that their attack chain does not require administrator passwords for execution.
Security firm watchTowr reported that they have already witnessed the exploit active in the wild shortly after its public disclosure.
“WordPress often faces scrutiny regarding security, yet highly impactful unauthenticated SQL injection and remote code execution vulnerabilities in WordPress core are relatively rare,” commented watchTowr CEO Benjamin Harris in a correspondence with BleepingComputer.
“This uniqueness drives urgency in addressing the issue before it becomes widely exploited. Our team has noted proof-of-concept exploits in the field, with initial signs of real-world exploitation surfacing.”
Given the availability of public proof-of-concept exploits and emerging reports of exploitation, administrators are strongly advised to upgrade to WordPress 7.0.2 or 6.9.5 at the earliest opportunity.
Security teams report that only 54% of successful attacks are documented, with only 14% of incidents resulting in warnings. The remaining threats go unnoticed.
Picus’ whitepaper details how to evaluate your SIEM and EDR rules through breach and attack simulations to ensure threats remain detected.
Source: www.bleepingcomputer.com