wp2shell: The WordPress Core RCE Chain Still Active 5 Weeks Later

Five weeks after disclosure, the WordPress vulnerability chain dubbed wp2shell is still finding victims. Two bugs in WordPress core — CVE-2026-63030 and CVE-2026-60137 — chain together into a pre-authentication remote code execution path that requires no plugins, no special configuration, and no credentials. An anonymous attacker on the internet can go from zero to PHP shell in a stock WordPress install. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on July 21, 2026. By late August, an estimated one in five affected sites still has not applied the patch.

Two Bugs, One Ugly Chain

The attack starts with the WordPress REST API batch-processing endpoint — /wp-json/batch/v1 (also reachable via /?rest_route=/batch/v1). The batch processor runs validation and request dispatch in separate loops. When wp_parse_url() fails on a nested malformed request, it populates an error array but not the dispatch array, leaving the loops misaligned. Subsequent requests in the same batch end up dispatched under the wrong handler — specifically, one that skips authentication checks. That is CVE-2026-63030, rated CVSS 9.8 by WPScan.

Once past the auth check, the attacker lands in the posts endpoint, where CVE-2026-60137 waits: the author__not_in parameter in WP_Query takes user input and interpolates it directly into raw SQL without adequate sanitization. Normal GET-based restrictions would block this, but the desynchronized batch handler bypasses those too. A UNION SELECT injection with hex-encoded values lets the attacker read from or write to the database. CISA rates this one CVSS 9.1.

The full kill chain: exploit the batch desynchronization to reach the SQL injection endpoint unauthenticated, use the SQLi to create a new administrator account, log in as that admin, and upload a malicious plugin containing a PHP webshell. Total preconditions: none. The attack works on a fresh WordPress install out of the box.

Exploitation Began Before Breakfast

SearchLight Cyber published the vulnerability on July 17, 2026. The WordPress team issued patches — versions 6.9.5 and 7.0.2 — the following day, with forced auto-updates pushed via the WordPress.org update infrastructure. That same weekend, proof-of-concept exploits circulated publicly. CrowdSec's threat sensors logged the first confirmed in-the-wild exploitation attempts on July 20, roughly 72 hours after disclosure. CISA KEV listing followed on July 21, with a federal remediation deadline of July 24.

F5 Labs captured live exploit payloads showing UNION SELECT statements with hex-encoded markers, targeting all three endpoint variants. The purpose-built exploit framework — identifiable by user-agent strings containing wp2shell and rezwp2shell — appeared in honeypots across multiple security firms within days.

Who Is Affected

Both CVEs affect WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. CVE-2026-60137 alone (the SQL injection without the auth bypass) also reaches WordPress 6.8.0 through 6.8.5. Sites running 6.7.x and below are not in scope. WordPress 6.9.5 and 7.0.2 are the minimum safe versions.

WordPress forced auto-updates pushed patches to many sites automatically, but auto-updates can fail silently — blocked by file permission issues, staging environments, managed host configurations that disable automatic updates, or stale caches masking the actual installed version. As of mid-August, about 18 percent of evaluated sites running an affected version remained unpatched, according to Defiant's patch-tracking dashboard. On a platform with hundreds of millions of installs, that is a substantial attack surface still open to anyone with a browser.

What to Check Right Now

Confirming the patch applied is the first step, but not the whole story. If attackers reached your site before the update, the webshell or rogue admin account they left behind persists after patching. Audit these specifically:

• Confirmed patch version: Log into wp-admin and verify the running version reads 6.9.5, 7.0.2, or later — not what the auto-update system tried to apply.
• Administrator accounts: Review every account in Users → Administrators. Remove any unfamiliar entries, particularly those created around July 17–20 with no post history.
• Installed plugins: Audit the plugin list for anything unexpected. Malicious plugins often use innocuous-sounding names like “Cache Helper” or “SEO Optimizer.”
• Filesystem scan: Search your wp-content/cache/, wp-content/uploads/, and plugin directories for recently modified PHP files. A file with eval(base64_decode(...)) or system($_GET[...]) is a webshell.
• HTTP access logs: Look for HTTP 207 Multi-Status responses to batch endpoint requests. Successful exploitation produces this response code. Requests containing author_exclude with SQL metacharacters, UNION, or SELECT are also a strong indicator.

Mitigation Beyond Patching

For sites that cannot patch immediately — staging environments, end-of-life hosts, or anything locked to a specific WordPress version — the practical interim control is a WAF rule blocking requests to the batch endpoints. Cloudflare released managed detection rules for wp2shell shortly after disclosure. ModSecurity users can block requests where the body contains nested requests arrays targeting the batch route. Disabling anonymous REST API access via a plugin like Disable REST API adds a second layer, though this breaks some plugins that rely on the API.

The longer-term lesson here is about patch latency. A zero-authentication RCE in WordPress core with active exploitation, a CISA KEV listing, and a federal 72-hour remediation deadline is not something to get to when convenient. At Falcon Internet, managed WordPress environments receive security updates as they drop — wp2shell was patched across our fleet within hours of the 6.9.5 and 7.0.2 releases. That window matters: this is exactly the kind of vulnerability where the gap between disclosure and patch is measured in hours, not days, and attackers know it.