CVE-2026-63030 (wp2shell): Unauthenticated Remote Code Execution in WordPress Core REST API Batch Endpoint via Chained SQL Injection (CVE-2026-60137)

CVE-2026-63030 (wp2shell) (TL-2026-1464), also tracked as wp2shell, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-17 and last reviewed 2026-07-19. It has no confirmed attribution, affects WordPress Foundation WordPress Core, references 2 CVEs (CVE-2026-63030, CVE-2026-60137), maps to 35 MITRE ATT&CK techniques (T1005, T1036, T1041), and is covered by 9 detection rules and 34 indicators of compromise.

Key facts for TL-2026-1464

Threat ID
TL-2026-1464
Also known as
wp2shell
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-17
Last reviewed
2026-07-19
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, news - media, ecommerce, government administration, education, health, finance, nonprofit, hosting
Target regions
Global
Detection rules
9
Indicators of compromise
34
Updates
2026-07-19 · 2 updates · revalidated 2× · latest source

Malware and tooling in CVE-2026-63030 (wp2shell)

Malware and tooling: WordPress core REST API batch handler

An unauthenticated remote code execution vulnerability dubbed "wp2shell" affects WordPress core 6.9.0-6.9.4 and 7.0.0-7.0.1, caused by a REST API batch-route confusion weakness (CWE-436) that, combined with an author__not_in WP_Query SQL injection flaw (CVE-2026-60137), allows a single unauthenticated HTTP request to the /wp-json/batch/v1 endpoint to achieve RCE on default installations with zero plugins. Discovered by Adam Kues of Assetnote (Searchlight Cyber) and disclosed via the WordPress HackerOne program on July 17, 2026; WordPress force-pushed automatic updates (6.9.5, 7.0.2, 6.8.6, 7.1 Beta 2) the same day given the scale of exposure across an estimated 500 million WordPress sites.

How CVE-2026-63030 (wp2shell) works

wp2shell is a pre-authentication remote code execution vulnerability in WordPress core discovered by security researcher Adam Kues of Assetnote, Searchlight Cyber's attack surface management division, and responsibly disclosed through the official WordPress HackerOne bug bounty program. The root cause is a REST API batch-route confusion issue (tracked as CVE-2026-63030, CWE-436: Interpretation Conflict) introduced into WordPress core after December 2, 2025. The WordPress REST API batch endpoint, exposed at /wp-json/batch/v1 (also reachable via ?rest_route=/batch/v1), allows multiple sub-requests to be bundled into a single call. A routing confusion in how the batch handler resolves and dispatches these nested sub-requests permits an unauthenticated attacker to reach an internal code path that was never intended to be reachable pre-authentication.

This routing confusion chains into a separate SQL injection vulnerability tracked as CVE-2026-60137, present in the author__not_in parameter handling of WP_Query since WordPress 6.8. By crafting a batch request that routes into the vulnerable WP_Query invocation, an attacker can inject arbitrary SQL. Because the underlying WordPress database layer permits certain multi-statement / stacked-query constructs reachable through this injection point, the SQL injection is escalated into full remote code execution rather than being limited to data exfiltration.

Exploitability is affected by object caching: Cloudflare's analysis noted the vulnerable code path is most readily reached "when a persistent object cache is not in use," meaning default/bare WordPress installations without a persistent object cache (e.g. Redis or Memcached via a caching plugin) are the most straightforwardly exploitable, though the underlying flaw exists in core regardless of caching configuration. No authentication, valid account, or user interaction of any kind is required — a single crafted anonymous HTTP request is sufficient.

Affected versions are WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 for the full RCE chain; the underlying SQL injection (CVE-2026-60137) alone affects 6.8.0 onward. WordPress.org shipped coordinated patches on July 17, 2026: 6.9.5 and 7.0.2 (both RCE + SQLi fixes), 6.8.6 (SQLi-only fix, since the RCE chain requires 6.9+), and 7.1 Beta 2. Given the severity and the scale of the WordPress install base, WordPress core force-enabled automatic background updates for all affected sites rather than waiting on manual/staged rollout, and the disclosing researchers withheld full technical exploitation details (PoC, exact vulnerable function names, and request payloads) at publication to give defenders a patching window. As of the July 17-18, 2026 advisories, no public proof-of-concept exploit and no confirmed in-the-wild exploitation had been observed, though Rapid7 assessed rapid PoC development as highly likely given the vulnerability's simplicity and the availability of AI-assisted vulnerability research/diffing tools capable of quickly reverse-engineering a patch diff into a working exploit. Cloudflare deployed emergency WAF managed-ruleset rules for both CVEs within hours of disclosure (17:03 UTC July 17, 2026), and multiple vendors (Rapid7, Aikido, Wordfence-adjacent researchers) published detection/scanning guidance and temporary mitigations — primarily blocking anonymous access to /wp-json/batch/v1 and the ?rest_route=/batch/v1 query-string equivalent at the WAF or plugin layer for sites unable to patch immediately.

MITRE ATT&CK techniques used in TL-2026-1464

Collection

T1005 Data from Local System; T1119 Automated Collection; T1557 Adversary-in-the-Middle

Defense Evasion

T1036 Masquerading; T1070.004 Indicator Removal: File Deletion; T1211 Exploitation for Stealth

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Execution

T1059 Command and Scripting Interpreter; T1059.011 Lua; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078.003 Valid Accounts: Local Accounts

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Discovery

T1082 System Information Discovery; T1087.001 Account Discovery: Local Account; T1518 Software Discovery

Credential Access

T1110 Brute Force; T1110.002 Brute Force: Password Cracking; T1212 Exploitation for Credential Access; T1552.001 Unsecured Credentials: Credentials In Files

Persistence

T1136 Create Account; T1136.001 Create Account: Local Account; T1505 Server Software Component; T1505.003 Server Software Component: Web Shell

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1486 Data Encrypted for Impact; T1491 Defacement; T1491.002 Defacement: External Defacement; T1496 Resource Hijacking; T1565.001 Data Manipulation: Stored Data Manipulation

Resource Development

T1587.004 Develop Capabilities: Exploits; T1588 Obtain Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595.002 Active Scanning: Vulnerability Scanning

Affected products and versions in CVE-2026-63030 (wp2shell)

  • WordPress Foundation — WordPress Core
    Vulnerable versions: 6.8.0-6.8.5 (SQLi only); 6.9.0; 6.9.1; 6.9.2; 6.9.3; 6.9.4; 7.0.0; 7.0.1; 7.1 Beta 1
    Fixed in: 6.8.6; 6.9.5; 7.0.2; 7.1 Beta 2

Remediation for CVE-2026-63030 (wp2shell)

Patches

  • WordPress 7.0.2 — fixes CVE-2026-63030 and CVE-2026-60137
  • WordPress 6.9.5 — fixes CVE-2026-63030 and CVE-2026-60137
  • WordPress 6.8.6 — fixes CVE-2026-60137 only (RCE chain not present pre-6.9)
  • WordPress 7.1 Beta 2 — fixes both for the 7.1 development branch

Immediate actions

  • Update WordPress core to 7.0.2 (7.0.x branch), 6.9.5 (6.9.x branch), or 6.8.6 (6.8.x branch, SQLi-only fix) immediately
  • Confirm WordPress core auto-updates are enabled and verify the site has actually pulled the forced background update rather than assuming it applied
  • Block anonymous/unauthenticated requests to /wp-json/batch/v1 and the ?rest_route=/batch/v1 query-string equivalent at the WAF or reverse-proxy layer until patched
  • Enable Cloudflare managed WAF rules 7dfb2bd4708d4b88b9911dc0550664b6 (RCE, CVE-2026-63030) and 1c060d3a371549219ee290d7ed933fcc (SQLi, CVE-2026-60137), or the free-tier equivalents ebd3f2df15c74ddcbf6220c9b5ec246a and db003b39b7774859a8d588ce33697a1a, with action set to Block

Workarounds

  • Install a plugin or must-use (mu-plugin) that rejects anonymous requests to the REST API batch route
  • Block /wp-json/batch/v1 and ?rest_route=/batch/v1 at a WAF or reverse proxy (e.g. Cloudflare, ModSecurity, nginx)
  • Disable the WordPress REST API entirely via a security plugin for sites that do not require it, as a last-resort temporary measure

Longer-term hardening

  • Deploy a persistent object cache (Redis/Memcached) as defense-in-depth, noting this reduces but does not eliminate exposure to the underlying routing confusion
  • Adopt a WAF/RASP capable of virtual-patching WordPress core CVEs ahead of manual patch cycles given WordPress's history of rapid post-disclosure exploitation
  • Establish monitoring for anomalous requests to /wp-json/batch/v1 with nested author__not_in or WP_Query-manipulating sub-request payloads
  • Maintain an inventory of managed WordPress fleet versions to identify sites lagging on forced auto-updates

CVEs associated with CVE-2026-63030 (wp2shell)

CVE-2026-63030, CVE-2026-60137

Weaknesses (CWE) in CVE-2026-63030 (wp2shell)

CWE-436, CWE-89, CWE-697, CWE-284

Timeline of CVE-2026-63030 (wp2shell)

  • The vulnerable REST API batch-route handling code is introduced into WordPress core (per Aikido's analysis, the vulnerable code path only appears in versions released after this date).
  • GHSA-fpp7-x2x2-2mjf (CVE-2026-60137) credits researchers TF1T, dtro, and haongo alongside Adam Kues for the SQL injection discovery.
  • watchTowr independently reports early signs of active in-the-wild exploitation following public exploit release.
  • PatchStack reports the first observed exploitation attempts against CVE-2026-63030 shortly before 7 PM ET, within hours of disclosure.
  • The Hacker News and Aikido Security publish coverage summarizing the flaw, patched versions, and temporary mitigations (blocking /wp-json/batch/v1 and ?rest_route=/batch/v1).
  • Cloudflare deploys emergency managed WAF ruleset rules for both CVE-2026-63030 (RCE) and CVE-2026-60137 (SQL injection) at 17:03 UTC, with default action set to Block, across both paid managed and free rulesets.
  • Rapid7 publishes an Emergent Threat Response (ETR) analysis (CVE-2026-63030), assessing rapid public PoC development as highly likely given the simplicity of the flaw and availability of AI-assisted patch-diffing tools.
  • Searchlight Cyber publishes its wp2shell research-center advisory, withholding full exploitation technical details (PoC, exact vulnerable functions, payloads) to give defenders a patching window.
  • WordPress releases coordinated patches: 6.9.5 and 7.0.2 (fixing both CVE-2026-63030 and CVE-2026-60137), 6.8.6 (SQL injection only), and 7.1 Beta 2, and force-enables automatic background updates across the affected install base given severity.
  • Adam Kues of Assetnote (Searchlight Cyber's attack surface management division) discloses the wp2shell vulnerability chain to the WordPress security team via the official HackerOne bug bounty program.
  • Multiple public PoC exploits appear on GitHub (e.g. Senanfurkan/wordpress-cve-2026-63030), including full pre-auth chain and password-hash-extraction-only variants.
  • As of this date, no public proof-of-concept exploit code and no confirmed in-the-wild exploitation attempts have been reported by any tracking vendor.
  • Security Affairs and other outlets (Cyber Kendra, CyberInsider) report on public availability of wp2shell exploits and warn of imminent mass scanning against the 500M+ WordPress install base.
  • As of this date, neither CVE-2026-63030 nor CVE-2026-60137 appears in the CISA Known Exploited Vulnerabilities (KEV) catalog per Rapid7's tracking.
  • Rapid7 makes authenticated vulnerability-check content available in its scanning products for CVE-2026-63030.

Update history for TL-2026-1464

Sources cited for CVE-2026-63030 (wp2shell)

Threats related to CVE-2026-63030 (wp2shell)

Detection coverage for TL-2026-1464

As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1464 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats