Full Report
Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites. The two security flaws, tracked as CVE-2026-63030 and CVE-2026-60137, have been codenamed wp2shell. "By the early hours of Saturday morning (UTC), successful exploitation was already well
Analysis Summary
# Vulnerability: wp2shell - Unauthenticated RCE in WordPress Core
## CVE Details
- **CVE ID:** CVE-2026-63030 and CVE-2026-60137
- **CVSS Score:** 10.0 (Critical - Estimated/Combined impact)
- **CWE:** CWE-89 (SQL Injection), CWE-287 (Improper Authentication), and Route Confusion.
## Affected Systems
- **Products:** WordPress CMS (Stock installs)
- **Versions:**
- **CVE-2026-60137 (SQLi Entry Point):** Version 6.8 and later.
- **CVE-2026-63030 (RCE Chain):** Version 6.9 and later (Released since Dec 2025).
- **Configurations:**
- Default/Stock installations are vulnerable.
- **Mitigating Factor:** RCE via CVE-2026-63030 is reportedly blocked if a persistent object cache (e.g., Redis or Memcached) is actively in use.
## Vulnerability Description
Codename **wp2shell**, this exploit utilizes a two-part chain to achieve Remote Code Execution (RCE) without authentication:
1. **Entry Point (CVE-2026-60137):** A route confusion bug in the WordPress REST API batch endpoint. Attackers can bypass authentication and invoke internal handlers. This exposes a flaw in `WP_Query` where improper sanitization of the `author__not_in` parameter allows for SQL injection.
2. **RCE (CVE-2026-63030):** Using the initial access granted by the SQL injection/route confusion, the attacker can move to achieve full execution of PHP code on the underlying server.
## Exploitation
- **Status:** Exploited in the wild (Mass scanning and active exploitation underway).
- **Complexity:** Low (No preconditions or specific plugins required).
- **Attack Vector:** Network (Remote, unauthenticated).
- **PoC Availability:** Public exploit code is available and currently being used by threat actors for mass scanning.
## Impact
- **Confidentiality:** Total (Full database exfiltration and credential harvesting).
- **Integrity:** Total (Ability to modify files, database entries, and site content).
- **Availability:** Total (Complete server compromise and web shell deployment).
## Remediation
### Patches
- Users must update to the latest version of WordPress core immediately. Though the article mentions the flaws exist in versions 6.8 and 6.9, it implies fixes have been released by the vendor following the July 2026 discovery.
### Workarounds
- Enable/Implement a **persistent object cache** (such as Redis), which reportedly prevents the RCE portion of the chain.
- Deploy a Web Application Firewall (WAF) with rules targeting REST API batch endpoint exploitation and `WP_Query` SQL manipulation.
## Detection
- **Indicators of Compromise (IoCs):**
- Presence of a 150 KB web shell disguised as a plugin named **CMSmap**.
- Unauthorized PHP files (web shells) in `wp-content/uploads` or plugin directories.
- Unusual REST API requests to the batch endpoint (typically `/wp-json/batch/v1`).
- **Detection Methods:**
- Monitor logs for the `author__not_in` parameter containing SQL syntax.
- Audit CMS user lists for new or unauthorized administrator accounts.
- Monitor for LFI attempts targeting `wp-config.php`.
## References
- hxxps[://]thehackernews[.]com/2026/07/wordpress-wp2shell-exploitation-grows.html
- hxxps[://]wp2shell[.]com/
- hxxps[://]kevintel[.]com/CVE-2026-63030#sensor-telemetry
- hxxps[://]blog[.]cloudflare[.]com/wordpress-vulnerabilities/