# wp2shell: WordPress Core REST API Batch-Route Confusion Chained with author__not_in SQL Injection (CVE-2026-63030 / CVE-2026-60137) Yields Unauthenticated Pre-Auth RCE

> Security researcher Adam Kues (Assetnote / Searchlight Cyber) disclosed via HackerOne that WordPress core's REST API batch endpoint (/wp-json/batch/v1) suffers a route-confusion weakness (CVE-2026-63030, CWE-436) that, chained with an unsanitized author__not_in WP_Query parameter SQL injection (CVE-2026-60137, CWE-89, CVSS 9.1), allows a fully unauthenticated attacker to achieve remote code execution on default WordPress installations with zero plugins required. WordPress shipped emergency fixes in 6.8.6, 6.9.5, 7.0.2, and 7.1 beta2 on 2026-07-17; no public PoC and no confirmed in-the-wild exploitation as of 2026-07-18.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-10-10T16:19:36.650Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1463
- **ID:** TL-2026-1463
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 103 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-60137, CVE-2026-63030

## Description

wp2shell is the public nickname (via the researcher's own checker tool at wp2shell.com and coverage on The Hacker News) for a two-bug exploit chain in WordPress core. The first bug, CVE-2026-63030, is a route-confusion weakness (CWE-436, Interpretation Conflict) in the REST API batch endpoint /wp-json/batch/v1, introduced when the batch endpoint shipped in WordPress 5.6 (released 2020-12-08) but which only became practically exploitable once WordPress 6.9 shipped (released 2025-12-02), per the researcher's own scoping notes. The batch endpoint allows a single unauthenticated HTTP request to be internally re-dispatched as a set of sub-requests; the confusion issue lets an attacker cause the batch dispatcher to route an internal sub-request in a way that reaches WP_Query with attacker-controlled parameters that would normally be inaccessible pre-authentication.

The second bug, CVE-2026-60137 (CVSS 3.1: 9.1 CRITICAL, CWE-89 SQL Injection), is an independent flaw in WP_Query itself: the author__not_in parameter is not properly sanitized before being incorporated into the generated SQL, so any code path (plugin, theme, or — as this chain demonstrates — WordPress core itself via the batch/REST confusion) that passes untrusted input into author__not_in is SQL-injectable. On its own, CVE-2026-60137 requires a plugin/theme to expose the parameter to untrusted input; the wp2shell chain's contribution is proving that WordPress core's own REST API batch route confusion supplies that untrusted-input path with zero plugins installed, turning a moderate-severity library bug into a critical, pre-auth, zero-plugin remote code execution primitive against the default install.

WordPress fixed both issues by patching three core files in the 7.0.2 release: wp-includes/rest-api/class-wp-rest-server.php, wp-includes/class-wp-query.php, and wp-includes/rest-api.php. The SQL injection (CVE-2026-60137) alone was also backported to 6.8.6 for sites on the 6.8 branch, which is not affected by the REST API route-confusion bug and therefore not vulnerable to the full RCE chain. WordPress 6.9.x and 7.0.x installations are vulnerable to the complete pre-auth RCE chain until patched to 6.9.5 or 7.0.2 respectively; 7.1 beta2 ships with both fixes.

Searchlight Cyber deliberately withheld exploit mechanics (specific batch payload construction, the exact SQLi-to-RCE pivot, and PoC code) at publication time to give defenders a patching window, publishing only affected-version ranges and interim mitigations. Interim mitigations recommended: WAF rules blocking both /wp-json/batch/v1 and ?rest_route=/batch/v1, disabling the REST API for unauthenticated users, or deploying a rest_pre_dispatch drop-in that rejects anonymous /batch/v1 requests. Researcher estimates put WordPress's install base above 500 million sites, with the vulnerable 6.9+ population being a smaller but still large subset of sites updated since December 2025.

## MITRE ATT&CK

- T1595.002 Active Scanning: Vulnerability Scanning
- T1592.002 Gather Victim Host Information: Software
- T1588.005 Obtain Capabilities: Exploits
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1505.003 Server Software Component: Web Shell
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1552.001 Unsecured Credentials: Credentials In Files
- T1082 System Information Discovery
- T1005 Data from Local System
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1491.001 Defacement: Internal Defacement
- T1587.004 Develop Capabilities: Exploits
- T1083 File and Directory Discovery
- T1059.011 Lua
- T1505 Server Software Component
- T1136 Create Account
- T1070.004 Indicator Removal: File Deletion
- T1518 Software Discovery
- T1119 Automated Collection
- T1136.001 Create Account: Local Account
- T1140 Deobfuscate/Decode Files or Information
- T1110.004 Brute Force: Credential Stuffing
- T1071.001 Application Layer Protocol: Web Protocols
- T1567 Exfiltration Over Web Service
- T1491.002 Defacement: External Defacement
- T1595 Active Scanning
- T1588.001 Obtain Capabilities: Malware
- T1587.001 Develop Capabilities: Malware
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1078.003 Valid Accounts: Local Accounts
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1070 Indicator Removal
- T1110.002 Brute Force: Password Cracking
- T1087.001 Account Discovery: Local Account
- T1046 Network Service Discovery

## Sources

- [New wp2shell WordPress Core Flaw Lets Attackers Gain RCE](https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html)
- [wp2shell — Unauthenticated RCE in WordPress Core (Searchlight Cyber Research)](https://slcyber.io/research-center/wp2shell)
- [Unauthenticated RCE in WordPress core (wp2shell)](https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell)
- [GHSA-ff9f-jf42-662q: REST API batch-route confusion leading to Remote Code Execution](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q)
- [GHSA-fpp7-x2x2-2mjf: author__not_in WP_Query SQL Injection](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf)
- [WordPress 7.0.2 Security Release](https://wordpress.org/news/2026/07/wordpress-7-0-2-release/)
- [NVD CVE-2026-63030](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-63030)
- [NVD CVE-2026-60137](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-60137)
- [wp2shell.com vulnerability checker](https://wp2shell.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1463