wp2shell: incident response guide (CVE-2026-63030 + CVE-2026-60137)
Found by web discovery while looking for coverage of CVE-2026-60137
Eye Security published forensic IR tooling for wp2shell (CVE-2026-63030/CVE-2026-60137), the unauthenticated WordPress core RCE chain, after WordPress.org forced auto-updates.
wp2shell chains a REST API batch-endpoint route-confusion bug (CVE-2026-63030) with an SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137), giving unauthenticated attackers rogue admin and code execution on default installs. Adam Kues of Searchlight Cyber discovered the flaw, a public PoC exists on GitHub, and WordPress.org forced automatic updates across an estimated 200M+ sites. Eye Security released a compromise-scanner WordPress plugin and browser extension and notes database artifacts (oEmbed cache rows, changesets) are the primary evidence since the attack is log-blind; fixed versions are 6.8.6, 6.9.5, and 7.0.2.
- Exploit chain escalates from pre-auth SQLi to rogue admin and webshell plugin
- Forced auto-updates likely protected most sites; pre-patch compromises persist
- Evidence lives in database artifacts, not access logs; exploit uses dozens of batch POSTs
- Full RCE chain may not trigger on sites using persistent object caches (Redis/Memcached)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-63030+1 related CVE | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE | 9.8 group max | 11% | KEVPoC ×9 | KEV |
From the original article
8 min read at research.eye.security
wp2shell is a critical unauthenticated RCE in WordPress core (CVE-2026-63030 + CVE-2026-60137). Check if you're exposed, detect compromise, and respond fast.
By @eyesecurity_ · research.eye.security
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.