# wp2shell RCE Chain in WordPress Core (CVE-2026-60137, CVE-2026-63030) — Emergency Patch Released

> WordPress core ships two chained flaws — a SQL injection in the author__not_in parameter of WP_Query (CVE-2026-60137) and a REST API batch-route confusion in /wp-json/batch/v1 (CVE-2026-63030) — that combine into unauthenticated, pre-conditionless remote code execution on any stock WordPress 6.9.0–6.9.4 / 7.0.0–7.0.1 / 7.1-beta install. WordPress.org shipped emergency patches (7.0.2, 6.9.5, 6.8.6 backport, 7.1 Beta 2) on 2026-07-17 and force-pushed them via the core auto-update system; the finders withheld exploit technical detail to buy defenders patch time.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-22T12:39:50.256Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1465
- **ID:** TL-2026-1465
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 47 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-60137, CVE-2026-63030

## Description

wp2shell is the public name for a two-CVE exploit chain in unmodified WordPress core with no plugin or configuration precondition. The root cause is CVE-2026-60137, a SQL injection in the `author__not_in` parameter of `WP_Query`, the class that underlies nearly every database query WordPress core issues; it affects the 6.8, 6.9, and 7.0 branches. On WordPress 6.9 and later, this SQL injection can be reached and escalated through CVE-2026-63030, a route-interpretation-confusion bug in the REST API batch endpoint (`/wp-json/batch/v1`, also reachable via the query-string form `?rest_route=/batch/v1`), a feature that has shipped unchanged since WordPress 5.6 in November 2020. The batch endpoint lets a single unauthenticated HTTP request fan out into multiple internally-routed sub-requests; a routing/type confusion in how those sub-requests are dispatched allows an attacker to reach the vulnerable WP_Query code path in a context that converts the SQL injection into remote code execution, reportedly most reliably when a persistent object cache is not configured (the WordPress default). No authentication, no non-default plugin, and no special configuration is required — a default install answering anonymous HTTP requests is exploitable. The vulnerability was reported by Adam Kues of Assetnote (Searchlight Cyber's attack-surface-management division) through WordPress's HackerOne bug-bounty program, with the SQL-injection component co-reported by researchers using the handles TF1T, dtro, and haongo. WordPress.org released patched versions 7.0.2 (full fix for both CVEs), 6.9.5 (backport of both fixes), 6.8.6 (SQL-injection-only backport, since the RCE escalation path does not exist before 6.9), and 7.1 Beta 2, and enabled forced automatic updates for all affected sites given the severity and reachable attack surface (an estimated 500M+ WordPress installs globally, with the vulnerable population limited to sites running 6.9.0+ released after 2025-12-02). As of publication no CVE/CVSS record had been formally published by NVD/MITRE and CISA KEV cannot list the flaw without a CVE entry; downstream trackers (Wordfence-style scoring reported in secondary coverage) put CVE-2026-60137 at CVSS 9.1 and CVE-2026-63030 at CVSS 7.5, though these are not yet confirmed against an authoritative NVD record. No public PoC and no confirmed in-the-wild exploitation had been observed at time of research; researchers assessed a public PoC was likely to surface quickly given the open-source, AI-assisted-analysis environment. Cloudflare shipped WAF managed-rule coverage for both CVEs (default action: Block) on the same day as disclosure. Recommended interim mitigation for sites that cannot immediately patch: block both the path `/wp-json/batch/v1` and the query parameter `rest_route=/batch/v1` at the WAF/edge, deploy a plugin or must-use drop-in that rejects anonymous requests to the REST batch route at the `rest_pre_dispatch` filter, or disable the REST API for unauthenticated users entirely — all of which carry a risk of breaking legitimate REST API integrations (Jetpack, the block editor, mobile apps, and third-party plugins that rely on the batch endpoint).

## MITRE ATT&CK

- T1595.002 Active Scanning: Vulnerability Scanning
- T1587.004 Develop Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059.011 Lua
- T1505.003 Server Software Component: Web Shell
- T1136.001 Create Account: Local Account
- T1068 Exploitation for Privilege Escalation
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 Indicator Removal: File Deletion
- T1110.004 Brute Force: Credential Stuffing
- T1518 Software Discovery
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1567 Exfiltration Over Web Service
- T1491.002 Defacement: External Defacement
- T1078 Valid Accounts
- T1211 Exploitation for Stealth
- T1212 Exploitation for Credential Access
- T1110.002 Brute Force: Password Cracking
- T1588.005 Obtain Capabilities: Exploits
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1552.001 Unsecured Credentials: Credentials In Files
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1213 Data from Information Repositories
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1098 Account Manipulation
- T1078.003 Valid Accounts: Local Accounts
- T1555 Credentials from Password Stores
- T1036 Masquerading
- T1119 Automated Collection
- T1102 Web Service

## Sources

- [New wp2shell RCE Vulnerability Impacts Millions of WordPress Sites, Emergency Patch Released](https://cybersecuritynews.com/wp2shell-rce-vulnerability/)
- [wp2shell: Pre Authentication RCE in WordPress Core](https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/)
- [CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core](https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/)
- [Unauthenticated RCE in WordPress core (wp2shell). Patch now!](https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell)
- [Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities](https://blog.cloudflare.com/wordpress-vulnerabilities/)
- [New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code](https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html)
- [WP2Shell: Critical WordPress Flaw Lets Anyone Run Code](https://www.cyberkendra.com/2026/07/wp2shell-critical-wordpress-flaw-lets.html)
- [WordPress wp2shell CVE-2026-63030: Patch Now](https://blog.gridinsoft.com/wordpress-wp2shell-cve-2026-63030-update/)
- [WordPress 7.0.2 Patches wp2shell: Critical Pre-Auth RCE - CVE-2026-63030](https://nebula.design/security/wp2shell-wordpress-rce/)
- [CVE-2026-60137 THREATINT record](https://cve.threatint.com/CVE/CVE-2026-60137)
- [CVE-2026-63030 THREATINT record](https://cve.threatint.com/CVE/CVE-2026-63030)
- [wp2shell exposure checker tool](https://wp2shell.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1465