Full Report
Wiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core (CVE-2026-63030 & CVE-2026-60137). Attackers are deploying persistent webshells on vulnerable servers. Organizations should prioritize patching or applying WAF mitigations.
Analysis Summary
# Vulnerability: wp2shell - Critical Pre-Auth RCE Chain in WordPress Core
## CVE Details
- **CVE ID:** CVE-2026-63030 & CVE-2026-60137
- **CVSS Score:** 10.0 (Critical - *Estimated based on pre-auth RCE impact*)
- **CWE:** Not specified, but involves SQL Injection (SQLi) and Remote Code Execution (RCE) via REST API batch processing.
## Affected Systems
- **Products:** WordPress Core
- **Versions:**
- **Full RCE Chain:** 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1.
- **SQL Injection (CVE-2026-60137 only):** 6.8.0 through 6.8.5.
- **Configurations:** Default installations released since December 2025 are vulnerable.
## Vulnerability Description
Dubbed "wp2shell," this vulnerability chain exploits the WordPress REST API batch processing endpoints. By sending crafted requests to the batch API, an unauthenticated attacker can bypass security controls to perform SQL injection (CVE-2026-60137) and ultimately achieve Remote Code Execution (CVE-2026-63030). The flaw allows for the deployment of persistent webshells and the execution of arbitrary PHP code on the underlying server.
## Exploitation
- **Status:** Exploited in the wild; Proof of Concept (PoC) available.
- **Complexity:** Low (Automated exploitation tools and frameworks are currently in use).
- **Attack Vector:** Network (Remote, unauthenticated).
## Impact
- **Confidentiality:** Total (Full access to database, config files, and user data).
- **Integrity:** Total (Ability to upload malicious plugins and modify system files).
- **Availability:** Total (Potential for full server takeover or site deletion).
## Remediation
### Patches
- Update WordPress Core to version **7.0.2** or later immediately.
### Workarounds
- **WAF Rules:** Block access to the WordPress Batch API endpoints:
- `/wp-json/batch/v1`
- `?rest_route=/batch/v1`
- **Disable Anonymous REST API:** Use security plugins or code snippets to restrict REST API access to authenticated users only.
## Detection
- **Indicators of Compromise (IoCs):**
- **User-Agents:** `wp2shell` and `rezwp2shell`.
- **Webshell Code:** Presence of `register_rest_route` callbacks utilizing `passthru(base64_decode(...))`.
- **Abnormal Requests:** HTTP POST requests to `/wp-admin/update.php?action=upload-plugin` from unknown IPs.
- **Detection Methods:**
- Monitor web logs for **HTTP 207/200 Multi-Status** responses specifically associated with the `/batch/v1` endpoint.
- Audit for new, unauthorized administrative users or unfamiliar plugins.
- Check for LFI attempts against `wp-config.php` involving `admin-ajax.php`.
## References
- **Vendor Advisory:** hxxps://wordpress[.]org/news/2026/07/wordpress-7-0-2-release/
- **Wiz Research:** hxxps://www[.]wiz[.]io/blog/wp2shell-cve-2026-63030-cve-2026-60137
- **Discovery Credit:** hxxps://slcyber[.]io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/