WP2Shell: The Complete Guide to WordPress RCE Vulnerability (CVE-2026-63030 & CVE-2026-60137)
In July 2026, the WordPress ecosystem faced one of its most critical security threats in nearly a decade. A vulnerability chain dubbed WP2Shell emerged, combining two distinct flaws that allow unauthenticated attackers to achieve remote code execution (RCE) on millions of WordPress websites. The discovery sent shockwaves through the security community, with active exploitation beginning within hours of public disclosure.
 |
| WP2Shell |
What makes WP2Shell particularly alarming is its scope. WordPress powers over 40% of the web, and the vulnerability affects versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. With public proof-of-concept exploits circulating and active in-the-wild exploitation confirmed within days, the urgency for website administrators to patch cannot be overstated.
This comprehensive guide explores everything you need to know about WP2Shell: the technical details of each vulnerability, how the attack chain works, which versions are affected, real-world exploitation activity, and step-by-step mitigation strategies to protect your WordPress websites.
Table of Contents
- 1. What Is WP2Shell?
- 2. CVE-2026-63030: The REST API Batch-Route Confusion
- 3. CVE-2026-60137: The SQL Injection Vulnerability
- 4. How the WP2Shell Attack Chain Works
- 5. Affected WordPress Versions
- 6. In-the-Wild Exploitation
- 7. How to Check If Your Site Is Vulnerable
- 8. Mitigation and Patching
- 9. Frequently Asked Questions
- 10. Conclusion
1. What Is WP2Shell?
WP2Shell is the name given to a two-vulnerability exploit chain affecting WordPress Core. Discovered by Adam Kues of Searchlight Cyber using OpenAI's GPT-5.6 Sol over a 10-hour research session, the chain represents a significant evolution in both vulnerability discovery and exploitation speed.
The name "WP2Shell" reflects the chain's ultimate goal: taking a WordPress site from a vulnerable state to a remote shell, giving attackers full control over the server. The attack requires no preconditions, works against a stock WordPress installation, and does not require any plugins or custom configurations.
Searchlight Cyber's research demonstrated that AI-assisted vulnerability discovery is becoming increasingly common. The vulnerability was discovered using GPT-5.6 Sol, highlighting a significant shift in how both defenders and attackers identify security flaws.
The Two Vulnerabilities at a Glance
| CVE | Description | CVSS Score |
|---|---|---|
| CVE-2026-63030 | REST API Batch-Route Confusion (allows authentication bypass) | 9.8 (Critical) |
| CVE-2026-60137 | SQL Injection via author__not_in parameter in WP_Query |
7.5 (High) |
When chained together, these vulnerabilities achieve a CVSS score of 9.8 (Critical) with the vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
2. CVE-2026-63030: The REST API Batch-Route Confusion
CVE-2026-63030 is a critical vulnerability in the WordPress REST API batch endpoint. Introduced in WordPress 6.9, this flaw allows attackers to abuse the REST API's batch processing functionality in ways that were never intended.
Technical Breakdown
The WordPress REST API includes a batch endpoint at /wp-json/batch/v1 that allows multiple sub-requests to be processed in a single HTTP call. The handler function serve_batch_request_v1() builds two parallel arrays:
$matches: Stores the matched handler for each sub-request$validation: Stores the validation result for each sub-request
When dispatching requests, the function indexes both arrays by the same offset. However, a critical bug exists: when wp_parse_url() fails on a sub-request path, the resulting WP_Error is pushed to $validation[] but not to $matches[].
This desynchronizes the two arrays. Every subsequent request is dispatched under the wrong handler, allowing an attacker to:
- Have a request validated by one endpoint's schema
- Have it dispatched through a completely different endpoint's callback
- Bypass authentication and authorization checks entirely
According to Cloudflare, CVE-2026-63030 enables unauthenticated RCE only when persistent object cache is not in use. However, this condition is met on the vast majority of default WordPress installations, making the vulnerability widely exploitable.
Why This Vulnerability Matters
On its own, CVE-2026-63030 does not provide remote code execution. It serves as the entry point that bypasses authentication, allowing an attacker to reach the SQL injection vulnerability without logging in. This is what makes the chain so dangerous—the route confusion flaw effectively removes all authentication barriers.
3. CVE-2026-60137: The SQL Injection Vulnerability
CVE-2026-60137 is a high-severity SQL injection vulnerability affecting the author__not_in parameter in WordPress's WP_Query class.
Technical Breakdown
The vulnerability exists because WordPress Core does not properly sanitize the author__not_in parameter when untrusted data is passed to it by a plugin or theme. This insufficient escaping on user-supplied parameters, combined with a lack of proper preparation on the existing SQL query, allows attackers to manipulate database queries.
In technical terms, when the author__not_in parameter is processed, the string-to-array cast skips the absint() sanitization that should prevent SQL injection. This makes it possible for unauthenticated attackers to append additional SQL queries to existing ones, enabling:
- Extraction of sensitive information from the database
- Theft of administrator password hashes
- Database manipulation through UNION-based, boolean-based, and time-based blind SQL injection techniques
Affected Versions
CVE-2026-60137 affects WordPress versions 6.8 through 7.0.1. However, the full WP2Shell RCE chain is only achievable on versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 because CVE-2026-63030 was introduced in WordPress 6.9.
Even if your site runs WordPress 6.8.x and is not vulnerable to the full RCE chain, you should still patch to 6.8.6 to address the standalone SQL injection vulnerability, which could allow attackers to extract sensitive database information.
4. How the WP2Shell Attack Chain Works
The WP2Shell attack chain is a sophisticated multi-step process that leverages both vulnerabilities in sequence. Here's a simplified breakdown:
Step 1: Authentication Bypass (CVE-2026-63030)
The attacker sends a specially crafted batch request to the /wp-json/batch/v1 endpoint. By including a malformed sub-request that causes wp_parse_url() to fail, the attacker desynchronizes the $matches and $validation arrays.
This desynchronization means that subsequent requests in the batch are dispatched under the wrong handler context, bypassing all authentication and authorization checks.
Step 2: SQL Injection (CVE-2026-60137)
Once inside the REST API without authentication, the attacker leverages the desynchronization to reach the vulnerable author__not_in parameter in WP_Query. The attacker injects malicious SQL through this parameter, achieving unauthenticated SQL injection.
The SQL injection can be:
- Boolean-based: Determining true/false conditions
- Time-based: Using SLEEP commands to infer database structure
- UNION-based: Extracting data directly from database tables
Step 3: Privilege Escalation
Using the SQL injection primitive, the attacker can:
- Poison WordPress's object cache with fake post objects using
UNION SELECT - Create a changeset that auto-publishes, elevating privileges
- Create a new administrator account without requiring any password
Step 4: Remote Code Execution
With administrator access established, the attacker can:
- Upload a malicious plugin
- Install PHP webshells (from simple one-liner backdoors to feature-rich, obfuscated shells disguised as plugins)
- Deploy a malicious plugin exposing a REST API endpoint for remote command execution
- Access the WordPress administration panel
The entire attack chain can be executed in a single HTTP request. Once setup is complete—discovering the table prefix and admin ID—the escalation payload fires in one round-trip, making detection extremely difficult.
5. Affected WordPress Versions
| Version Range | Status | Vulnerability |
|---|---|---|
| 6.8.0 – 6.8.5 | SQL Injection only | CVE-2026-60137 |
| 6.9.0 – 6.9.4 | 🔴 Full RCE Chain | CVE-2026-63030 + CVE-2026-60137 |
| 7.0.0 – 7.0.1 | 🔴 Full RCE Chain | CVE-2026-63030 + CVE-2026-60137 |
| 6.9.5 | ✅ Patched | Fixed |
| 7.0.2 | ✅ Patched | Fixed |
| 6.8.6 | ✅ Patched | Fixed (SQL injection only) |
Summary of Affected Versions
- Full RCE chain: WordPress 6.9.0 – 6.9.4 and 7.0.0 – 7.0.1
- SQL injection only: WordPress 6.8.0 – 6.8.5
- Not affected: WordPress versions earlier than 6.8
6. In-the-Wild Exploitation
The timeline of WP2Shell exploitation is alarming in its speed:
- July 17, 2026 – Disclosure: WordPress released security updates addressing the wp2shell vulnerabilities alongside two GitHub Security Advisories. Searchlight Cyber published initial research but chose to withhold technical specifics given the severity.
- July 17, 2026 (23:29 UTC) – First Probing: The first exploitation-related probing was observed just hours after disclosure.
- July 17, 2026 (23:42 UTC) – First SQL Injection Attempt: A clear SQL injection attempt was observed just 13 minutes after the initial probing.
- July 18–20, 2026 – Active Exploitation: Multiple security firms confirmed in-the-wild exploitation. Public proof-of-concept exploits began appearing on GitHub.
- July 20, 2026 – Full Technical Breakdown: Searchlight Cyber published the complete technical breakdown of the attack chain.
Attackers' Activities
According to cloud security company Wiz, observed attacks leveraging wp2shell include:
- Mass-scanning for vulnerable WordPress installations
- Abuse of WordPress plugin upload functionality to install malicious add-ons
- Installation of PHP webshells ranging from simple backdoors to feature-rich, obfuscated shells
- Querying the WordPress REST API to collect administrator usernames and email addresses
- Local file inclusion attempts targeting
wp-configthroughadmin-ajax.phpto retrieve database credentials and authentication keys - Deployment of malicious plugins exposing REST API endpoints for remote command execution
- Creation of rogue administrator accounts
Global Impact
Telemetry data shows that 13 unique IP addresses from Switzerland, Germany, the UK, Indonesia, Lithuania, the Netherlands, and Singapore have been linked to exploitation. The attacks have expanded from targeting WordPress-specific sensors to broad Internet scanning.
As of the latest tracking, the global patch rate stands at approximately 81.6% out of a sample of 124,580 websites evaluated. This means nearly 20% of sampled sites remain vulnerable.
WatchTowr CEO Benjamin Harris warned: "This is going to hurt. WordPress runs on hundreds of millions of websites globally. Some of those will be auto-patched by their hosting providers, but plenty will not, and that is where the damage will be done".
7. How to Check If Your Site Is Vulnerable
Method 1: Check Your WordPress Version
- Log in to your WordPress admin dashboard
- Navigate to Dashboard → Updates
- Check your current WordPress version
- If you're running:
- 6.9.0 – 6.9.4: VULNERABLE (full RCE chain)
- 7.0.0 – 7.0.1: VULNERABLE (full RCE chain)
- 6.8.0 – 6.8.5: Vulnerable to SQL injection only
- 6.9.5 or 7.0.2 or higher: PATCHED
Method 2: Use the Official Testing Tool
Searchlight Cyber launched wp2shell.com, a free testing tool that allows administrators to check whether their WordPress installation is vulnerable.
Method 3: Automated Scanners
Several security firms have released non-intrusive scanners:
- wp2shell-scan by FullHunt
- Non-intrusive checker by kulichr (sends no SQL injection or RCE payloads)
- Escape DAST and AI Pentesting to confirm exploitability
Use non-intrusive scanners that do not send actual exploit payloads. Even "just testing" with untested injection payloads on production sites can cause real damage.
8. Mitigation and Patching
Immediate Actions
1. Update WordPress Immediately
The most effective way to remediate WP2Shell is to update to a patched version:
| Current Version | Update To |
|---|---|
| 6.9.0 – 6.9.4 | 6.9.5 or higher |
| 7.0.0 – 7.0.1 | 7.0.2 or higher |
| 6.8.0 – 6.8.5 | 6.8.6 or higher |
WordPress.org has enabled forced automatic updates for affected supported installations. However, administrators should still verify that each internet-facing WordPress website has successfully upgraded.
2. Review Server Logs
Check your server logs for wp2shell-related requests. Look for:
- Requests to
/wp-json/batch/v1with unusual payloads - SQL injection patterns (UNION, SLEEP, etc.)
- Unusual POST requests to
/wp/v2/users - Requests to
/wp-content/cache/(webshells may be placed here)
3. Inspect for Compromise
If your site runs an affected version, assume it may have been compromised:
- Check for newly created administrator accounts
- Inspect installed plugins for unauthorized additions
- Look for rogue PHP file additions
- Check the
/wp-content/cache/directory for suspicious files - Review your
.htaccessfile for unauthorized modifications
4. Enable Web Application Firewall (WAF)
Security providers have released WAF rules to detect and block WP2Shell exploitation:
- Cloudflare has rolled out rules to detect exploitation and protect customers
- BitNinja has released new WAF rules
- Wordfence provides protection for its users
Long-Term Security Recommendations
- Enable automatic updates for WordPress Core
- Implement a Web Application Firewall
- Regularly audit administrator accounts
- Monitor server logs for unusual activity
- Keep all plugins and themes updated
- Use strong, unique passwords for all admin accounts
- Consider using a persistent object cache (which may mitigate the RCE vector)
9. Frequently Asked Questions
What is WP2Shell?
WP2Shell is a vulnerability chain combining two WordPress Core vulnerabilities—CVE-2026-63030 and CVE-2026-60137—that allows unauthenticated remote code execution.
When was WP2Shell disclosed?
WP2Shell was disclosed on July 17, 2026, with security updates released the same day.
Which WordPress versions are affected?
WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected by the full RCE chain. Versions 6.8.0 through 6.8.5 are affected by the SQL injection alone.
How severe is WP2Shell?
The chain has a CVSS score of 9.8 (Critical). An unauthenticated attacker can achieve remote code execution on default WordPress installations with no plugins required.
Is WP2Shell being exploited in the wild?
Yes. Multiple security firms have confirmed active in-the-wild exploitation within days of public disclosure.
How can I protect my WordPress site?
Update to WordPress 6.9.5, 7.0.2, or 6.8.6 immediately. Also review server logs, inspect for compromise, and consider implementing a Web Application Firewall.
Did WordPress force automatic updates?
Yes, WordPress.org enabled forced automatic updates for affected supported installations.
Can I check if my site is vulnerable without exploiting it?
Yes. Use the official testing tool at wp2shell.com or non-intrusive scanners.
What do attackers do after exploiting WP2Shell?
Attackers install PHP webshells, malicious plugins, create rogue admin accounts, and steal database credentials.
Was this vulnerability discovered using AI?
Yes. Searchlight Cyber discovered the vulnerability using OpenAI GPT-5.6 Sol over a 10-hour research session.
10. Conclusion
WP2Shell represents one of the most critical security threats to WordPress in nearly a decade. The vulnerability chain—combining a REST API batch-route confusion flaw with a SQL injection vulnerability—enables unauthenticated attackers to achieve remote code execution on millions of websites.
The speed of exploitation has been unprecedented:
- Hours between disclosure and PoC emergence
- 13 minutes between first probing and SQL injection attempt
- Days between disclosure and widespread active exploitation
🚀 Protect Your WordPress Site Now
Don't wait for automatic updates to take effect. Verify your WordPress version immediately and update to 6.9.5, 7.0.2, or 6.8.6 today. Review your logs for signs of compromise, audit your admin accounts, and consider implementing a Web Application Firewall for additional protection.
The WP2Shell vulnerability chain serves as a stark reminder of the evolving threat landscape:
- AI-assisted vulnerability discovery is becoming mainstream
- Exploitation windows are collapsing—from days to hours
- Default installations are no longer safe—attackers target core software
For WordPress administrators, the message is clear: patch now, verify your updates, and assume compromise if you were running a vulnerable version. The hundreds of millions of websites running WordPress are only as secure as the actions their administrators take today.
The future of web security belongs to those who prioritize speed, vigilance, and proactive defense. WP2Shell is today's reminder—but it won't be the last.
Have you patched your WordPress site against WP2Shell? Share your experience in the comments below. And if you found this guide helpful, don't forget to share it with your network! 🚀