WordPress Core "wp2shell" RCE flaws get public exploits, patch now

1. Executive summary

Two vulnerabilities in WordPress Core — CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection in the author__not_in parameter of WP_Query) — can be chained into an unauthenticated remote code execution (RCE) attack dubbed "wp2shell" against default installations running versions 6.9.0–6.9.4 and 7.0.0–7.0.1. Public proof-of-concept exploits have been published on GitHub, and WordPress has triggered forced automatic updates for affected installations. EMEA financial services running internet-facing WordPress sites for marketing, customer portals, or CMS-driven content must verify patch status immediately; successful exploitation yields complete server compromise with no authentication and no plugins required.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 24: digital operational resilience testing — general requirements	Public PoC exploits exist for an unauthenticated RCE chain in a widely deployed CMS; affected versions are identifiable and patches are available.	Clients must verify that all internet-facing WordPress instances are patched to 6.9.5 / 7.0.2 and include this in vulnerability management and resilience testing programmes.
DORA Art. 19: reporting of major ICT-related incidents and cyber threats	A critical unauthenticated RCE with public exploits targeting a CMS powering public-facing financial services websites constitutes a major cyber threat requiring assessment against classification thresholds.	If a client's WordPress instance is compromised via this chain, the incident must be classified and reported to competent authorities under DORA timelines if it meets the major-incident criteria.

3. Technical analysis & attack chain

Vulnerability overview

The "wp2shell" attack chain combines two independent flaws in WordPress Core:

CVE-2026-63030 — REST API batch-route confusion vulnerability. The GitHub Security Advisory classifies severity as Critical, though the assigned CVSS score is 7.5. The vulnerable code path can be reached when a persistent object cache is not in use. This flaw was introduced in WordPress 6.9. It enables an unauthenticated attacker to exploit the WordPress REST API batch endpoint (/wp-json/batch/v1 and ?rest_route=/batch/v1).
CVE-2026-60137 — SQL injection in the author__not_in parameter of WP_Query. WordPress classifies this as high severity. It affects WordPress 6.8.0 through 6.8.5, 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1. On its own it is an SQL injection; when chained with CVE-2026-63030 it enables remote code execution. On versions 6.8.x, the SQL injection exists but cannot be chained to RCE because the batch-route confusion bug was introduced in 6.9.

Confirmed attack chain

An unauthenticated, anonymous attacker targets a default WordPress installation (no plugins required, no preconditions).
The attacker exploits CVE-2026-63030 via the REST API batch endpoint (/wp-json/batch/v1 or ?rest_route=/batch/v1), leveraging batch-route confusion to reach code paths not intended for anonymous access.
The attacker chains CVE-2026-60137 to perform SQL injection via the author__not_in parameter of WP_Query, extracting data from the WordPress database.
Public PoC exploits demonstrate extraction of WordPress password hashes via the SQL injection, followed by cracking an administrator password hash.
With administrator credentials, the attacker achieves full compromise of the WordPress installation and its underlying server.

Affected versions

WordPress branch	Affected versions	Fixed version
Earlier than 6.9	Not affected by CVE-2026-63030	No action required for this CVE
6.9	6.9.0 through 6.9.4	6.9.5
7.0	7.0.0 through 7.0.1	7.0.2
7.1 beta	Affected beta versions not fully specified	7.1 Beta 2

Exploitation status

As of the Rapid7 publication (July 17, 2026, 17:45 ET), Rapid7 stated it was not aware of publicly confirmed in-the-wild exploitation. However, BleepingComputer reported that multiple public proof-of-concept exploits have since been published on GitHub, some of which combine the two vulnerabilities to extract password hashes and crack administrator credentials. The discrepancy between Rapid7's "no confirmed exploitation" statement and BleepingComputer's report of public PoCs reflects the rapidly evolving situation; clients should assume functional exploits are available to any attacker.

Confidence caveat: The existence of public PoC exploits is reported by BleepingComputer (single-sourced for that specific claim). Searchlight Cyber is withholding technical exploit details. The vulnerability mechanism descriptions are corroborated across Rapid7, Help Net Security, and BleepingComputer.

4. Mitigation & containment

P1 — Within 24 hours

Verify that every internet-facing WordPress installation has been updated to WordPress 6.9.5 (for the 6.9 branch) or WordPress 7.0.2 (for the 7.0 branch). WordPress has enabled forced automatic updates for affected versions, but administrators must confirm successful application on each site.
For sites on the 7.1 beta track, update to 7.1 Beta 2.
Inventory all WordPress instances across the estate, including those managed by third parties or marketing agencies, and confirm version status for each.

P2 — Within 72 hours

For organisations unable to immediately patch, deploy one of the following temporary mitigations (these are stopgaps only, not substitutes for patching):
Install a WordPress plugin that blocks anonymous access to the REST API entirely.
Block requests to /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF level.
If using Cloudflare as a proxy, confirm that WAF rules for both CVE-2026-63030 and CVE-2026-60137 are enabled. Cloudflare has deployed protections across all plans including free accounts.
Review web server and WordPress application logs for evidence of exploitation attempts targeting the REST API batch endpoint or anomalous WP_Query / author__not_in parameter usage (see §6).

P3 — Within 7 days

Ensure all WordPress instances on the 6.8.x branch are updated to at least 6.8.5 or, preferably, migrated to a fully patched 6.9.5 or 7.0.2 release. While 6.8.x cannot be chained to RCE via this specific chain, the SQL injection (CVE-2026-60137) remains exploitable on those versions.
Validate that a persistent object cache (e.g., Redis, Memcached) is configured where feasible — Cloudflare reported the vulnerable code path for CVE-2026-63030 can be reached when a persistent object cache is not in use. This is an additional hardening measure, not a patch substitute.
Update vulnerability scanning tooling to include authenticated checks for CVE-2026-63030 and CVE-2026-60137 (Rapid7 InsightVM/Nexpose content release July 20, 2026).

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, file paths) are available in the source material. The sources describe observable behaviours related to exploitation of this vulnerability chain.

Behavioural indicators

Behaviour	Where to observe	Confidence
Unauthenticated POST requests to `/wp-json/batch/v1` or `?rest_route=/batch/v1`	Web server access logs, WAF logs	High
SQL injection patterns in `author__not_in` parameter within REST API requests	WAF logs, database query logs, WordPress debug logs	High
Batch-route confusion patterns — multiple nested or unexpected route references within a single batch API request	WAF logs, application-layer inspection	Medium
Sudden extraction of WordPress `user_pass` hashes from the `wp_users` table	Database monitoring, DAM alerts	High
Creation of new administrator accounts or password changes following anomalous REST API activity	WordPress audit logs, authentication logs	Medium

6. Detection

The sources provide specific endpoint paths and parameter names that constitute genuine exploit artefacts for this threat chain. Detection rules are authored below.

Sigma rule — REST API batch endpoint access (exploitation indicator)

title: WordPress wp2shell REST API Batch Endpoint Exploitation Attempt
id: a7c3f1d2-2026-4b8e-9f1a-adtrace20260719
status: experimental
description: Detects requests targeting the WordPress REST API batch endpoint, associated with CVE-2026-63030 exploitation attempts
author: Adverse Trace
date: 2026/07/19
references:

  - https://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/
  - https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core
logsource:
  category: webserver
  product: apache/nginx/iis
detection:
  selection_uri:
    cs-uri-query|contains:

      - 'rest_route=/batch/v1'
  selection_path:
    cs-uri-stem|contains:

      - '/wp-json/batch/v1'
  selection_param:
    cs-uri-query|contains:

      - 'author__not_in'
  condition: (selection_uri or selection_path) or (selection_path and selection_param)
fields:

  - src_ip
  - dst_ip
  - cs-uri-stem
  - cs-uri-query
  - cs-method
  - cs-user-agent
falsepositives:

  - Legitimate batch API usage by authorised WordPress plugins or integrations
  - Administrative tooling performing batch REST API operations
level: high

Sigma rule — WordPress user table access via SQL injection (post-exploitation indicator)

title: WordPress wp2shell SQL Injection via WP_Query author__not_in
id: b8d4e2c3-2026-5a9f-0e2b-adtrace20260719b
status: experimental
description: Detects SQL injection attempts targeting the author__not_in parameter in WP_Query, associated with CVE-2026-60137
author: Adverse Trace
date: 2026/07/19
references:

  - https://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/
  - https://www.helpnetsecurity.com/2026/07/18/wordpress-vulnerabilities-wp2shell-cve-2026-60137-cve-2026-60137/
logsource:
  category: webserver
  product: apache/nginx/iis
detection:
  selection_param:
    cs-uri-query|contains:

      - 'author__not_in'
  selection_sqli_patterns:
    cs-uri-query|contains:

      - 'UNION'
      - 'SELECT'
      - 'wp_users'
      - 'user_pass'
  condition: selection_param and selection_sqli_patterns
fields:

  - src_ip
  - dst_ip
  - cs-uri-stem
  - cs-uri-query
  - cs-method
falsepositives:

  - Legitimate use of author__not_in parameter by authorised WordPress plugins with well-formed queries
level: high

7. Sources

BleepingComputer — "WordPress Core 'wp2shell' RCE flaws get public exploits, patch now" — https://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/ — 2026-07-18
Rapid7 Blog — "CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core" — https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core — 2026-07-17
Help Net Security — "Two new high severity WordPress vulnerabilities, patch immediately!" — https://www.helpnetsecurity.com/2026/07/18/wordpress-vulnerabilities-wp2shell-cve-2026-60137-cve-2026-60137/ — 2026-07-18
GitHub Security Advisories — "Premmerce Dev Tools plugin for WordPress RCE via missing authorization" — https://github.com/advisories/GHSA-gjvr-7x7p-x3vq — (related but distinct advisory, not part of the wp2shell chain)

8. Adverse Trace position

This is a critical-severity vulnerability chain with public proof-of-concept exploits available, targeting the most widely deployed CMS on the internet. The attack requires no authentication, no plugins, and no user interaction against a default WordPress installation — the barrier to exploitation is low and lowering further as PoCs circulate. EMEA financial services with any internet-facing WordPress instance (marketing sites, customer portals, blog platforms) should treat patching to 6.9.5 or 7.0.2 as an immediate P1 action and verify that WordPress forced auto-updates have actually applied. The GitHub advisory classifies CVE-2026-63030 as Critical despite its CVSS score of 7.5; we concur with that classification given the chained RCE impact. No CISA-KEV entry or confirmed in-the-wild exploitation was reported as of Rapid7's July 17 publication, but BleepingComputer's July 18 report of public PoC exploits on GitHub changes the risk calculus materially — assume active exploitation is imminent or underway. Adverse Trace will monitor for confirmed in-the-wild exploitation reports, additional IOCs from post-exploitation activity, and any threat actor attribution. Attribution is unconfirmed; no named actor has been linked to this vulnerability chain in the available source material.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.