WordPress wp2shell Vulnerabilities Exploited in the Wild (CVE-2026 ...
Public exploit code emerged for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137); CISA set a July 24 patching deadline.
CVE-2026-63030 (REST API batch-route confusion) chained with CVE-2026-60137 (SQL injection in WP_Query's author__not_in) enables pre-authentication RCE in WordPress core, affecting versions 6.8.0-7.0.1. Multiple researchers published working PoCs on GitHub that extract password hashes, crack admin credentials, and upload malicious plugins. CISA added both CVEs to its KEV catalog with a July 24, 2026 deadline, and WordPress.org enabled forced auto-updates; fixes shipped in 6.8.6, 6.9.5, and 7.0.2.
- Public PoCs combine the two bugs to dump password hashes then deploy a malicious plugin
- WordPress powers 500M+ sites, magnifying the exposure
- Workaround: block anonymous access to /wp-json/batch/v1 and ?rest_route=/batch/v1
- Qualys detection available via QIDs 531916, 531867, 734738, 734739
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-63030 +1 in the same advisory: …60137 | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE WordPress Core contains an interpretation-conflict flaw (CWE-436) in the REST API batch endpoint that causes route confusion, allowing requests to be dispatched to an unintended route. When chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), this allows a remote, unauthenticated attacker to inject SQL and escalate to remote code execution. Any WordPress site running 6.9.x before 6.9.5 or 7.0.x before 7.0.2 is affected, with no privileges or user interaction required (CVSS 3.1: 9.8). Exploitation is confirmed in the wild: the issue was added to CISA's KEV on 2026-07-21, EPSS is 97.3% (100th percentile), and a public PoC is reportedly fueling mass scanning under the 'wp2shell' label. Do: Upgrade immediately to WordPress 6.9.5 (for 6.9.x) or 7.0.2 (for 7.0.x), or later, which fixes both this flaw and the chained SQL injection CVE-2026-60137; prioritize internet-facing sites because exploitation is unauthenticated and being mass-scanned. Review web and REST API logs for suspicious batch requests, SQL errors, unexpected admin users, or modified files. Organizations in scope for CISA BOD 26-04 must apply the required mitigations per vendor instructions or discontinue use. | 9.8 group max | 97% | KEV PoC |
| massest. hundreds of thousands to millions of WordPress sites (core runs roughly 40% of the web; only unpatched 6.9.x/7.0.x instances remain exploitable) |
Full article339 words · extracted from threatprotect.qualys.com · click to collapse
Threat actors have released public exploit code for the WordPress core remote code execution vulnerabilities, named wp2shell. Tracked as CVE-2026-63030 and CVE-2026-60137, the vulnerabilities can be chained together to achieve pre-authentication remote code execution.
Adam Kues of Searchlight Cyber discovered and reported the vulnerability to WordPress. The article mentioned that more than 500 million websites use WordPress, which enhances the impact of the vulnerabilities multifold.
The Searchlight Cyber team has responsibly withheld the technical details of the vulnerability’s exploitation.
CISA added both the CVEs to its Known Exploited Vulnerabilities Catalog, urging users to patch the vulnerabilities before July 24, 2026.
CVE-2026-63030 is a REST API batch-route confusion vulnerability that can be chained with the SQL injection vulnerability to achieve remote code execution.
The second vulnerability, CVE-2026-60137, is an SQL injection flaw in the author__not_in parameter of WP_Query.
The publicly available exploit code
While the Searchlight Cyber is not releasing technical details, multiple researchers have published public proof-of-concept exploits on GitHub.
Some publicly available exploits combine the two vulnerabilities to extract WordPress password hashes via SQL injection, then crack an administrator password to log in, upload a malicious plugin, and execute commands.
Affected Versions
CVE-2026-63030:
- WordPress 6.9.0 – 6.9.4
- WordPress 7.0.0 – 7.0.1
CVE-2026-60137:
- WordPress 6.8.0 – 6.8.5
- WordPress 6.9.0 – 6.9.4
- WordPress 7.0.0 – 7.0.1
Workaround
Users can temporarily protect their instance by blocking anonymous access to the batch API, either by:
- Installing a plugin that blocks anonymous access to the rest API entirely; or
- Blocking /wp-json/batch/v1 and ?rest_route=/batch/v1 at a WAF level.
Mitigation
CVE-2026-63030:
- WordPress 6.9.5
- WordPress 7.0.2
CVE-2026-60137:
- WordPress 6.8.6
- WordPress 6.9.5
- WordPress 7.0.2
Theadvisorystates, “Due to the severity, the WordPress.org team has enabled forced updates via the auto-update system for sites running affected versions.”
For more information, please refer to the WordPress Security Advisory.
Qualys Detection
Qualys customers can scan their devices with QIDs 531916, 531867, 734738, and 734739 to detect vulnerable assets.
Continue to follow Qualys Threat Protection for more coverage on the latest vulnerabilities.
References
https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
Text extracted automatically; images, tables and formatting may be missing. Original: https://threatprotect.qualys.com/2026/07/20/wordpress-wp2shell-vulnerabilities-exploited-in-the-wild-cve-2026-63030-cve-2026-60137/