Chained WordPress flaws allow unauthenticated site takeover
Original title: Hackers Can Take Over WordPress Websites Without a Password Using Two Security Flaws
WP2Shell chains CVE-2026-63030 and CVE-2026-60137; fixes are 6.8.6, 6.9.5 and 7.0.2.
Researchers describe WP2Shell, a chain of CVE-2026-63030 in the WordPress REST batch controller and CVE-2026-60137 SQL injection on the posts endpoint, affecting default installs without a plugin. Public exploit code exists, and F5 Labs captured automated attempts, including from 185.242.3.238, that did not include a web shell. The full chain affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1; 6.8.0–6.8.5 is affected only by the SQL injection. Fixes shipped July 17 in 6.8.6, 6.9.5 and 7.0.2, with forced automatic updates.
Unconfirmed: Observed exploit requests do not by themselves confirm successful compromise or web-shell deployment.
- The batch route is /wp-json/batch/v1, also reachable via rest_route parameters.
- Akamai describes creating an administrator without cracking password hashes.
- The same 735-byte payload hit at least two US-based F5 sensors.
- Temporary files matching temp-write-test-* may appear under wp-content/.
- Versions before 6.8 are unaffected by these issues.
Impact: Unauthenticated path to admin access and remote code execution
| Product | Affected | Fixed in |
|---|---|---|
| WordPress | 6.9.0–6.9.4 and 7.0.0–7.0.1 for the full chain; 6.8.0–6.8.5 for SQL injection only | 6.8.6, 6.9.5, and 7.0.2 |
- 1.Verify WordPress is 6.8.6, 6.9.5 or 7.0.2 rather than assuming auto-update.
- 2.Inspect POST requests to /wp-json/batch/v1 and alternate rest_route paths.
- 3.Review new administrator accounts, plugins, PHP files and database changes.
- Vendors
- WordPress
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-63030+1 related CVE | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE | 9.8 group max | 11% | KEVPoC ×7 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 185.242.3.238 | shell. F5 Labs observed an exploit request originating from 185.242.3.238 , delivering nested batch requests and UNION-based SQL inje |
From the original article
3 min read at gbhackers.com
Hackers can compromise vulnerable WordPress websites without stealing passwords by chaining two security flaws in the platform’s core. Disclosed in July 2026, the chain involves CVE-2026-63030 and CVE-2026-60137. Unlike attacks dependent on vulnerable extensions, WP2Shell affects default WordPress installations without requiring a third-party plugin.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.