WP2Shell chains two WordPress flaws into admin and web-shell access
Original title: WP2Shell Attack Lets Hackers Create WordPress Admin Accounts and Install Web Shells Without Login
Seqrite’s proof of concept uses CVE-2026-63030 and CVE-2026-60137 but does not show widespread live exploitation.
Seqrite documented WP2Shell, a chain of WordPress Core flaws disclosed in July 2026 that starts from an unauthenticated REST API request and can create an administrator and install a plugin web shell. CVE-2026-63030 confuses batch-route handling; CVE-2026-60137 is SQL injection via author_exclude. Full-chain exposure is listed for 6.9.0–6.9.4 and 7.0.0–7.0.1, with 6.8.0–6.8.5 affected only by the injection. Fixed releases are 6.8.6, 6.9.5, and 7.0.2.
Unconfirmed: Seqrite does not establish widespread live exploitation.
- The batch endpoint is /wp-json/batch/v1; the injection alone does not execute code.
- Artifacts include temp-write-test-* files, wp2shell_*.zip, and wp2shell_<hex> plugin folders.
- A sample archive named wp2shell_4e9b3641.zip was staged under uploads/2026/10/.
- httpd.exe writes alone are not proof, because normal plugin installs can cause them.
- A patched version does not show that an earlier compromise was removed.
Impact: Unauthenticated admin creation and a plugin web shell
| Product | Affected | Fixed in |
|---|---|---|
| WordPress | 6.9.0–6.9.4 and 7.0.0–7.0.1 for the full chain; 6.8.0–6.8.5 for CVE-2026-60137 | 6.8.6, 6.9.5, and 7.0.2 |
- 1.Upgrade to 6.8.6, 6.9.5, or 7.0.2, or a later supported release.
- 2.Review unexpected administrators, new PHP in plugins or cache, and wp2shell filenames.
- 3.If indicators are found, preserve evidence, disable suspicious plugins, and reset affected credentials.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-63030+1 related CVE | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE | 9.8 group max | 11% | KEVPoC ×7 | KEV |
From the original article
3 min read at cybersecuritynews.com
WP2Shell combines two WordPress Core flaws to move from an unauthenticated request to server-side code execution. It can let an attacker create an administrator account and install a plugin-based web shell. Seqrite’s October 16 analysis lists affected releases, but does not establish widespread live exploitation.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.