# CVE-2026-63030 (wp2shell): Unauthenticated Remote Code Execution in WordPress Core REST API Batch Endpoint via Chained SQL Injection (CVE-2026-60137)

> An unauthenticated remote code execution vulnerability dubbed "wp2shell" affects WordPress core 6.9.0-6.9.4 and 7.0.0-7.0.1, caused by a REST API batch-route confusion weakness (CWE-436) that, combined with an author__not_in WP_Query SQL injection flaw (CVE-2026-60137), allows a single unauthenticated HTTP request to the /wp-json/batch/v1 endpoint to achieve RCE on default installations with zero plugins. Discovered by Adam Kues of Assetnote (Searchlight Cyber) and disclosed via the WordPress HackerOne program on July 17, 2026; WordPress force-pushed automatic updates (6.9.5, 7.0.2, 6.8.6, 7.1 Beta 2) the same day given the scale of exposure across an estimated 500 million WordPress sites.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-19T05:40:59.765Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1464
- **ID:** TL-2026-1464
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-63030, CVE-2026-60137

## Description

wp2shell is a pre-authentication remote code execution vulnerability in WordPress core discovered by security researcher Adam Kues of Assetnote, Searchlight Cyber's attack surface management division, and responsibly disclosed through the official WordPress HackerOne bug bounty program. The root cause is a REST API batch-route confusion issue (tracked as CVE-2026-63030, CWE-436: Interpretation Conflict) introduced into WordPress core after December 2, 2025. The WordPress REST API batch endpoint, exposed at /wp-json/batch/v1 (also reachable via ?rest_route=/batch/v1), allows multiple sub-requests to be bundled into a single call. A routing confusion in how the batch handler resolves and dispatches these nested sub-requests permits an unauthenticated attacker to reach an internal code path that was never intended to be reachable pre-authentication.

This routing confusion chains into a separate SQL injection vulnerability tracked as CVE-2026-60137, present in the author__not_in parameter handling of WP_Query since WordPress 6.8. By crafting a batch request that routes into the vulnerable WP_Query invocation, an attacker can inject arbitrary SQL. Because the underlying WordPress database layer permits certain multi-statement / stacked-query constructs reachable through this injection point, the SQL injection is escalated into full remote code execution rather than being limited to data exfiltration.

Exploitability is affected by object caching: Cloudflare's analysis noted the vulnerable code path is most readily reached "when a persistent object cache is not in use," meaning default/bare WordPress installations without a persistent object cache (e.g. Redis or Memcached via a caching plugin) are the most straightforwardly exploitable, though the underlying flaw exists in core regardless of caching configuration. No authentication, valid account, or user interaction of any kind is required — a single crafted anonymous HTTP request is sufficient.

Affected versions are WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 for the full RCE chain; the underlying SQL injection (CVE-2026-60137) alone affects 6.8.0 onward. WordPress.org shipped coordinated patches on July 17, 2026: 6.9.5 and 7.0.2 (both RCE + SQLi fixes), 6.8.6 (SQLi-only fix, since the RCE chain requires 6.9+), and 7.1 Beta 2. Given the severity and the scale of the WordPress install base, WordPress core force-enabled automatic background updates for all affected sites rather than waiting on manual/staged rollout, and the disclosing researchers withheld full technical exploitation details (PoC, exact vulnerable function names, and request payloads) at publication to give defenders a patching window. As of the July 17-18, 2026 advisories, no public proof-of-concept exploit and no confirmed in-the-wild exploitation had been observed, though Rapid7 assessed rapid PoC development as highly likely given the vulnerability's simplicity and the availability of AI-assisted vulnerability research/diffing tools capable of quickly reverse-engineering a patch diff into a working exploit. Cloudflare deployed emergency WAF managed-ruleset rules for both CVEs within hours of disclosure (17:03 UTC July 17, 2026), and multiple vendors (Rapid7, Aikido, Wordfence-adjacent researchers) published detection/scanning guidance and temporary mitigations — primarily blocking anonymous access to /wp-json/batch/v1 and the ?rest_route=/batch/v1 query-string equivalent at the WAF or plugin layer for sites unable to patch immediately.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1059.011 Lua
- T1505 Server Software Component
- T1505.003 Server Software Component: Web Shell
- T1136 Create Account
- T1211 Exploitation for Stealth
- T1070.004 Indicator Removal: File Deletion
- T1552.001 Unsecured Credentials: Credentials In Files
- T1518 Software Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1119 Automated Collection
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1595.002 Active Scanning: Vulnerability Scanning
- T1587.004 Develop Capabilities: Exploits
- T1136.001 Create Account: Local Account
- T1078.003 Valid Accounts: Local Accounts
- T1068 Exploitation for Privilege Escalation
- T1036 Masquerading
- T1110.002 Brute Force: Password Cracking
- T1212 Exploitation for Credential Access
- T1087.001 Account Discovery: Local Account
- T1071.001 Application Layer Protocol: Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1491.002 Defacement: External Defacement
- T1592 Gather Victim Host Information
- T1588 Obtain Capabilities
- T1110 Brute Force
- T1557 Adversary-in-the-Middle
- T1567 Exfiltration Over Web Service
- T1491 Defacement
- T1486 Data Encrypted for Impact
- T1496 Resource Hijacking

## Sources

- [ETR: CVE-2026-63030 (wp2shell) — A Critical Remote Code Execution Vulnerability in WordPress Core](https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core)
- [wp2shell: Pre Authentication RCE in WordPress Core](https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/)
- [Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities](https://blog.cloudflare.com/wordpress-vulnerabilities/)
- [Unauthenticated RCE in WordPress core (wp2shell). Patch now!](https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell)
- [New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code](https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html)
- [GHSA-ff9f-jf42-662q: WordPress REST API batch-route confusion RCE](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q)
- [NVD - CVE-2026-63030](https://nvd.nist.gov/vuln/detail/CVE-2026-63030)
- [WordPress 7.0.2 Release](https://wordpress.org/news/2026/07/wordpress-7-0-2-release/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1464