CVEs: CVE-2026-63030 (REST API batch-route confusion) + CVE-2026-60137 (SQL injection in WP_Query) Affected: WordPress 6.9.0-6.9.4, 7.0.0-7.0.1 (full RCE chain); 6.8.0-6.8.5 (SQL injection only) Fixed in: 6.9.5, 7.0.2, and 6.8.6 (released July 17, 2026) Severity: Critical – unauthenticated, zero preconditions, public exploit now available
When I read about wp2shell (CVE-2026-63030), I got scared that asecurityguru.com might be affected. I quickly logged into my wp-admin dashboard and checked the WordPress version and thankfully it was already 7.0.2. It get’s very scary when your own website is impacted because of security vulnerability.
An estimated 500 million+ websites run WordPress. On July 17, 2026, WordPress’s security team disclosed a vulnerability chain that lets a completely anonymous, unauthenticated attacker take full control of a default WordPress installation — no login, no vulnerable plugin, no special configuration. Just a reachable site running an affected version.
This one is personal for anyone running a WordPress site, including this one. If you haven’t checked your WordPress version in the last 24 hours, this post is your reason to stop and check right now.
How wp2shell Actually Works
wp2shell isn’t one bug — it’s two separately-rated, individually “moderate” vulnerabilities that become critical when chained together.
CVE-2026-63030 — REST API batch-route confusion. WordPress’s REST API has a batch endpoint (/wp-json/batch/v1) that’s existed since WordPress 5.6, designed to let multiple API requests be submitted in one call. A route confusion bug in this endpoint — introduced in WordPress 6.9 — causes attacker-controlled input to be misrouted to the wrong internal handler. On its own, this is a bounded problem, rated High (CVSS 7.5).
CVE-2026-60137 — SQL injection in WP_Query. A SQL injection vulnerability in the author__not_in parameter of WP_Query — the core class that builds most of WordPress’s database queries. This flaw has existed since WordPress 6.8. On its own, exploiting it required more direct access to trigger.
The chain. Combined, an anonymous attacker sends a request to the batch endpoint, uses the route confusion to smuggle a malicious author__not_in parameter into a WP_Query call, and rides that into the SQL injection — which a public proof-of-concept has already demonstrated can dump the full user table, including admin password hashes, and ultimately reach code execution.
This is exactly the kind of vulnerability chaining worth understanding as a pattern — two individually “fine” bugs that add up to something far worse than either alone.
Why This Escalated Fast
The timeline here matters:
- July 17, 2026 — WordPress discloses both CVEs and ships patches (6.9.5, 7.0.2, 6.8.6) simultaneously, alongside Cloudflare WAF protections
- Same day — because of the severity, WordPress took the unusual step of force-pushing the update via auto-update to all affected sites, rather than waiting for administrators to manually apply it
- Within roughly 24-48 hours — a working, public proof-of-concept exploit tool was published on GitHub, demonstrating the complete attack chain end-to-end, including reading admin password hashes from the database
That last point is the one that changes the calculus. Searchlight Cyber, the firm that discovered the bug, deliberately withheld technical exploit details at initial disclosure specifically to buy site owners time to patch. Once a full public PoC exists, that buffer is gone — this moved from “patch when convenient” to “patch immediately” within about two days.
Which WordPress Versions Are Affected
| WordPress Version | Status |
|---|---|
| 6.8.5 and earlier | Not affected by RCE chain |
| 6.8.0 – 6.8.5 | SQL injection only (CVE-2026-60137), no RCE path |
| 6.9.0 – 6.9.4 | Full RCE chain affected |
| 7.0.0 – 7.0.1 | Full RCE chain affected |
| 7.1 beta (pre-release) | Affected |
The RCE chain specifically requires the route confusion bug introduced in 6.9 — that’s why 6.8.x sites face the SQL injection risk but not the full remote code execution path.
What You Need to Do Right Now
Check your version and confirm the patch applied. WordPress force-pushed this update automatically, but “should have updated automatically” and “actually updated” aren’t always the same thing — confirm directly:
- Log into your WordPress Dashboard → Updates
- Confirm you’re running 6.9.5, 7.0.2, 6.8.6, or later
- If not, click “Update Now” immediately, or download the release directly from WordPress.org
If you can’t update immediately, Searchlight Cyber’s recommended stopgap measures (temporary only):
- Install a plugin that blocks anonymous access to the REST API entirely
- Block the
/wp-json/batch/v1and?rest_route=/batch/v1endpoints at your WAF level - Treat both as temporary bridges — they may break legitimate site functionality and are not a substitute for patching
After patching, don’t assume you’re in the clear if you were running a vulnerable version for any length of time before updating. Given the public PoC can already dump admin credentials, if your site was on an affected version:
- Rotate all administrator passwords
- Review recently created admin accounts for anything unfamiliar
- Check for unexpected plugin installations, theme edits, or new files
- Consider checking your access logs for requests to
/wp-json/batch/v1or?rest_route=/batch/v1around the disclosure window
Raghu’s Expert Take
If you are also running a business on a vulnerable version of WordPress then please upgrade your wordpress version to a safe one. Secondly, make sure you apply security patches to your CMS site as we do in an enterprise environment.
Frequently Asked Questions
Is wp2shell being actively exploited in the wild right now? As of the most recent reporting, no in-the-wild exploitation has been confirmed. However, a full working proof-of-concept exploit is now publicly available on GitHub, which significantly raises the likelihood of real-world exploitation attempts in the near term. Treat this as an active risk, not a theoretical one.
Does the forced auto-update mean I don’t need to do anything? No. WordPress enabled forced automatic updates for affected installations, but you should still manually confirm your site actually received and applied the update, particularly if your host has auto-updates disabled at the server level or if your site uses a management setup that overrides WordPress core’s default update behavior.
Do I need to worry about this if my site runs a lot of plugins? Yes, if anything, more so. This vulnerability exists in WordPress Core itself — it doesn’t require any plugin to be present or vulnerable. A “stock” install with zero plugins is exploitable. Plugins don’t protect against this; only the core patch does.
What’s the difference between the two CVEs in this chain? CVE-2026-63030 is the entry point — a flaw in how the REST API batch endpoint routes requests, letting an attacker reach code paths they shouldn’t. CVE-2026-60137 is the payload — a SQL injection in a WordPress core query class. Neither alone is as severe as the two combined into a single attack chain.
How can I tell if my site was already compromised before I patched? Check for unfamiliar administrator accounts, unexpected file changes (especially in plugin/theme directories), unusual outbound connections, and review your web server logs for requests to the batch API endpoint during the vulnerable window. If you find anything suspicious, treat it as a confirmed compromise and follow full incident response procedures rather than just removing the suspicious element.
Next Steps
For more on how vulnerability chains like this one get scored and why individually-moderate bugs can combine into critical risk, see What Is CVSS Score? Severity Ratings Explained. For the defense-in-depth principle that explains why layered security matters even when one component fails, see Core Security Principles Every Engineer Should Know.
Check the CVE Tracker for live CVSS scores on wp2shell and other newly disclosed vulnerabilities.
For structured, hands-on learning across DevSecOps, Application Security, and AI Security, explore Raghu’s courses on Udemy.
Sources and References
- BleepingComputer: WordPress Core wp2shell RCE flaws get public exploits
- The Hacker News: New wp2shell WordPress Core Flaw
- SOCRadar: WordPress wp2shell CISO FAQ and Fix
- WordPress.org Release Notes — official patch announcement
- ASecurityGuru: What Is CVSS Score?
- ASecurityGuru: Core Security Principles Every Engineer Should Know
Raghu the Security Expert has 20 years of experience in Security, DevSecOps, AI Security, and Penetration Testing. He has helped 80,000+ students upskill themselves in DevSecOps, Application Security, and AI Security. Follow his work on LinkedIn, YouTube, and Udemy.
