WordPress wp2shell Vulnerabilities Exploited in the Wild (CVE-2026 ...
Found by web discovery while looking for coverage of CVE-2026-60137
Public exploit code emerged for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137); CISA set a July 24 patching deadline.
CVE-2026-63030 (REST API batch-route confusion) chained with CVE-2026-60137 (SQL injection in WP_Query's author__not_in) enables pre-authentication RCE in WordPress core, affecting versions 6.8.0-7.0.1. Multiple researchers published working PoCs on GitHub that extract password hashes, crack admin credentials, and upload malicious plugins. CISA added both CVEs to its KEV catalog with a July 24, 2026 deadline, and WordPress.org enabled forced auto-updates; fixes shipped in 6.8.6, 6.9.5, and 7.0.2.
- Public PoCs combine the two bugs to dump password hashes then deploy a malicious plugin
- WordPress powers 500M+ sites, magnifying the exposure
- Workaround: block anonymous access to /wp-json/batch/v1 and ?rest_route=/batch/v1
- Qualys detection available via QIDs 531916, 531867, 734738, 734739
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-63030+1 related CVE | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE | 9.8 group max | 11% | KEVPoC ×7 | KEV |
From the original article
1 min read at threatprotect.qualys.comTracked as CVE-2026-63030 and CVE-2026-60137, the vulnerabilities can be chained together to achieve pre-authentication remote code execution. Adam Kues of Searchlight Cyber discovered and reported the vulnerability to WordPress.
threatprotect.qualys.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.