wp2shell RCE Chain in WordPress Core (CVE-2026-60137, CVE-2026-63030) — Emergency Patch Released

wp2shell RCE Chain in WordPress Core (CVE-2026-60137 (TL-2026-1465), also tracked as wp2shell, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-18 and last reviewed 2026-07-22. It has no confirmed attribution, affects WordPress Foundation WordPress Core, references 2 CVEs (CVE-2026-60137, CVE-2026-63030), maps to 33 MITRE ATT&CK techniques (T1005, T1036, T1059.004), and is covered by 9 detection rules and 47 indicators of compromise.

Key facts for TL-2026-1465

Threat ID
TL-2026-1465
Also known as
wp2shell
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-18
Last reviewed
2026-07-22
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
all-sectors-hosting-wordpress, media-publishing, ecommerce, government administration, education, small-business, blogging-cms
Target regions
global
Detection rules
9
Indicators of compromise
47
Updates
2026-07-22 · 7 updates · revalidated 7× · latest source

Malware and tooling in wp2shell RCE Chain in WordPress Core (CVE-2026-60137

Malware and tooling: Aikido Zen, Disable WP REST API plugin, wp2shell.com checker

WordPress core ships two chained flaws — a SQL injection in the author__not_in parameter of WP_Query (CVE-2026-60137) and a REST API batch-route confusion in /wp-json/batch/v1 (CVE-2026-63030) — that combine into unauthenticated, pre-conditionless remote code execution on any stock WordPress 6.9.0–6.9.4 / 7.0.0–7.0.1 / 7.1-beta install. WordPress.org shipped emergency patches (7.0.2, 6.9.5, 6.8.6 backport, 7.1 Beta 2) on 2026-07-17 and force-pushed them via the core auto-update system; the finders withheld exploit technical detail to buy defenders patch time.

How wp2shell RCE Chain in WordPress Core (CVE-2026-60137 works

wp2shell is the public name for a two-CVE exploit chain in unmodified WordPress core with no plugin or configuration precondition. The root cause is CVE-2026-60137, a SQL injection in the `author__not_in` parameter of `WP_Query`, the class that underlies nearly every database query WordPress core issues; it affects the 6.8, 6.9, and 7.0 branches. On WordPress 6.9 and later, this SQL injection can be reached and escalated through CVE-2026-63030, a route-interpretation-confusion bug in the REST API batch endpoint (`/wp-json/batch/v1`, also reachable via the query-string form `?rest_route=/batch/v1`), a feature that has shipped unchanged since WordPress 5.6 in November 2020. The batch endpoint lets a single unauthenticated HTTP request fan out into multiple internally-routed sub-requests; a routing/type confusion in how those sub-requests are dispatched allows an attacker to reach the vulnerable WP_Query code path in a context that converts the SQL injection into remote code execution, reportedly most reliably when a persistent object cache is not configured (the WordPress default). No authentication, no non-default plugin, and no special configuration is required — a default install answering anonymous HTTP requests is exploitable. The vulnerability was reported by Adam Kues of Assetnote (Searchlight Cyber's attack-surface-management division) through WordPress's HackerOne bug-bounty program, with the SQL-injection component co-reported by researchers using the handles TF1T, dtro, and haongo. WordPress.org released patched versions 7.0.2 (full fix for both CVEs), 6.9.5 (backport of both fixes), 6.8.6 (SQL-injection-only backport, since the RCE escalation path does not exist before 6.9), and 7.1 Beta 2, and enabled forced automatic updates for all affected sites given the severity and reachable attack surface (an estimated 500M+ WordPress installs globally, with the vulnerable population limited to sites running 6.9.0+ released after 2025-12-02). As of publication no CVE/CVSS record had been formally published by NVD/MITRE and CISA KEV cannot list the flaw without a CVE entry; downstream trackers (Wordfence-style scoring reported in secondary coverage) put CVE-2026-60137 at CVSS 9.1 and CVE-2026-63030 at CVSS 7.5, though these are not yet confirmed against an authoritative NVD record. No public PoC and no confirmed in-the-wild exploitation had been observed at time of research; researchers assessed a public PoC was likely to surface quickly given the open-source, AI-assisted-analysis environment. Cloudflare shipped WAF managed-rule coverage for both CVEs (default action: Block) on the same day as disclosure. Recommended interim mitigation for sites that cannot immediately patch: block both the path `/wp-json/batch/v1` and the query parameter `rest_route=/batch/v1` at the WAF/edge, deploy a plugin or must-use drop-in that rejects anonymous requests to the REST batch route at the `rest_pre_dispatch` filter, or disable the REST API for unauthenticated users entirely — all of which carry a risk of breaking legitimate REST API integrations (Jetpack, the block editor, mobile apps, and third-party plugins that rely on the batch endpoint).

MITRE ATT&CK techniques used in TL-2026-1465

Collection

T1005 Data from Local System; T1119 Automated Collection; T1213 Data from Information Repositories

Defense Evasion

T1036 Masquerading; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.011 Lua; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts; T1078.003 Valid Accounts: Local Accounts

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1102 Web Service

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Persistence

T1098 Account Manipulation; T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell

Credential Access

T1110.002 Brute Force: Password Cracking; T1110.004 Brute Force: Credential Stuffing; T1212 Exploitation for Credential Access; T1552.001 Unsecured Credentials: Credentials In Files; T1555 Credentials from Password Stores

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1491.002 Defacement: External Defacement; T1565.001 Data Manipulation: Stored Data Manipulation

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits

Reconnaissance

T1595.002 Active Scanning: Vulnerability Scanning

Affected products and versions in wp2shell RCE Chain in WordPress Core (CVE-2026-60137

  • WordPress Foundation — WordPress Core
    Vulnerable versions: 6.8.0-6.8.5; 6.9.0-6.9.4; 7.0.0-7.0.1; 7.1-beta (pre-beta2)
    Fixed in: 6.8.6; 6.9.5; 7.0.2; 7.1 Beta 2

Remediation for wp2shell RCE Chain in WordPress Core (CVE-2026-60137

Patches

  • WordPress 7.0.2 — full fix for CVE-2026-60137 and CVE-2026-63030
  • WordPress 6.9.5 — backport of both fixes
  • WordPress 6.8.6 — backport of CVE-2026-60137 (SQL injection) only
  • WordPress 7.1 Beta 2 — includes the same fix set

Immediate actions

  • Upgrade WordPress core to 7.0.2 (full fix for both CVEs)
  • If on the 6.9 branch and unable to jump to 7.0.x, upgrade to 6.9.5
  • If on the 6.8 branch, upgrade to 6.8.6 to close the SQL injection component (CVE-2026-60137)
  • If running 7.1 beta, upgrade to 7.1 Beta 2
  • Verify WordPress.org's forced auto-update actually applied on internet-facing installs; do not assume forced update reached hosts with auto-update disabled

Workarounds

  • Block the path /wp-json/batch/v1 AND the query parameter rest_route=/batch/v1 at the WAF/edge (both routing forms must be blocked)
  • Deploy a must-use plugin or drop-in that rejects anonymous requests to the REST batch route via the rest_pre_dispatch filter
  • Install a plugin that blocks unauthenticated REST API access (e.g. Disable WP REST API) as a stopgap — note this can break legitimate REST-dependent functionality (block editor, Jetpack, mobile apps, third-party plugin integrations)
  • Use the wp2shell.com checker tool published by Searchlight Cyber to assess exposure prior to patching

Longer-term hardening

  • Deploy a WAF in front of WordPress with managed rules for CVE-2026-60137 and CVE-2026-63030 (e.g. Cloudflare Managed Ruleset rule IDs 1c060d3a371549219ee290d7ed933fcc / db003b39b7774859a8d588ce33697a1a for CVE-2026-60137 and 7dfb2bd4708d4b88b9911dc0550664b6 / ebd3f2df15c74ddcbf6220c9b5ec246a for CVE-2026-63030)
  • Enable a runtime application self-protection / RASP layer (e.g. Aikido Zen or equivalent) that inspects user input flowing to the database to catch future WP_Query-class SQL injection
  • Establish a change-monitoring baseline for wp-includes/rest-api/class-wp-rest-server.php, wp-includes/class-wp-query.php, and wp-includes/rest-api.php to detect unauthorized core-file tampering post-compromise
  • Track WordPress core version drift across the fleet; do not rely solely on forced auto-updates for critical infrastructure

CVEs associated with wp2shell RCE Chain in WordPress Core (CVE-2026-60137

CVE-2026-60137, CVE-2026-63030

Weaknesses (CWE) in wp2shell RCE Chain in WordPress Core (CVE-2026-60137

CWE-89, CWE-863, CWE-436, CWE-434, CWE-284, CWE-697, CWE-502, CWE-444, CWE-841

Timeline of wp2shell RCE Chain in WordPress Core (CVE-2026-60137

  • WordPress 5.6 ships the REST API batch endpoint (/wp-json/batch/v1) that would later become the route-confusion vector for CVE-2026-63030.
  • WordPress 6.9.0 is released, introducing the code path that lets the WP_Query SQL injection be reached and escalated to RCE via the batch endpoint.
  • Adam Kues of Assetnote (Searchlight Cyber) reports the REST API batch-route confusion RCE to WordPress via HackerOne; SQL-injection co-reporters TF1T, dtro, and haongo separately flag the WP_Query author__not_in injection (exact HackerOne submission date approximate based on disclosure-to-patch coordination window).
  • Coalition notifies policyholders of the wp2shell vulnerability roughly 24 hours ahead of observed active exploitation.
  • PatchStack begins reporting exploitation attempts against both CVEs starting shortly before 7 PM ET, hours after public disclosure.
  • GitHub Security Advisories GHSA-ff9f-jf42-662q (CVE-2026-63030) and GHSA-fpp7-x2x2-2mjf (CVE-2026-60137) are published with the confirmed root-cause mechanism (REST batch array-index desynchronization + author__not_in type-juggling SQLi).
  • Searchlight Cyber publishes the wp2shell.com exposure checker tool so site owners can test their own instance without technical exploit details being released.
  • Cloudflare ships Managed Ruleset coverage (default action: Block) for both CVE-2026-60137 and CVE-2026-63030 the same day as the WordPress patch.
  • WordPress.org releases emergency patched versions 7.0.2, 6.9.5, 6.8.6, and 7.1 Beta 2 for CVE-2026-60137 and CVE-2026-63030, and enables forced automatic updates across affected installs.
  • Hadrian publishes a detailed technical breakdown of the WP_REST_Server::serve_batch_request_v1() array-misalignment root cause plus a response-differential detection methodology (block_cannot_read vs rest_term_invalid) that works even when version strings are hidden.
  • At least one secondary source reports the wp2shell.com scanner site returning a 404 error shortly after its public launch.
  • A public detection PoC (Senanfurkan/wordpress-cve-2026-63030 on GitHub) is released, demonstrating a non-destructive route-confusion probe and a time-based blind SQL injection technique.
  • No public proof-of-concept and no confirmed in-the-wild exploitation reported by any tracked source; researchers assess a public PoC is likely to surface quickly given WordPress's open-source codebase.
  • Cyber Security News, The Hacker News, CyberKendra, GridInsoft, and Rapid7 publish coverage; no CVSS score or CVE record from NVD/MITRE confirmed as of publication, so CISA KEV cannot yet list the flaw.
  • watchTowr and VulnCheck independently confirm active in-the-wild exploitation; VulnCheck catalogs more than two dozen unique public PoC implementations, including variants that eliminate the credential-cracking step for direct unauthenticated RCE.
  • Adam Kues publishes a detailed report on the AI-assisted discovery methodology (OpenAI GPT5.6 Sol Ultra, up to four autonomous agents, ~6 hours, ~$25 inference cost); Infosecurity Magazine and SecureLayer7 independently cover the methodology alongside the original GBHackers report.
  • Rapid7 schedules authenticated vulnerability check content for Exposure Command/InsightVM to be released for CVE-2026-63030.
  • CISA adds CVE-2026-60137 (WordPress Core SQL Injection Vulnerability) and CVE-2026-63030 (WordPress Core Interpretation Conflict Vulnerability) to its Known Exploited Vulnerabilities catalog under BOD 26-04, requiring federal agency remediation on CISA-mandated timelines.

Update history for TL-2026-1465

Sources cited for wp2shell RCE Chain in WordPress Core (CVE-2026-60137

Threats related to wp2shell RCE Chain in WordPress Core (CVE-2026-60137

Detection coverage for TL-2026-1465

As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1465 across Splunk SPL, Microsoft KQL and Sigma, covering 47 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats