Attackers Can Take Over WordPress Sites Using Newly Released wp2shell Exploits
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-63030 +1 in the same advisory: …60137 | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE WordPress Core contains an interpretation-conflict flaw (CWE-436) in the REST API batch endpoint that causes route confusion, allowing requests to be dispatched to an unintended route. When chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), this allows a remote, unauthenticated attacker to inject SQL and escalate to remote code execution. Any WordPress site running 6.9.x before 6.9.5 or 7.0.x before 7.0.2 is affected, with no privileges or user interaction required (CVSS 3.1: 9.8). Exploitation is confirmed in the wild: the issue was added to CISA's KEV on 2026-07-21, EPSS is 97.3% (100th percentile), and a public PoC is reportedly fueling mass scanning under the 'wp2shell' label. Do: Upgrade immediately to WordPress 6.9.5 (for 6.9.x) or 7.0.2 (for 7.0.x), or later, which fixes both this flaw and the chained SQL injection CVE-2026-60137; prioritize internet-facing sites because exploitation is unauthenticated and being mass-scanned. Review web and REST API logs for suspicious batch requests, SQL errors, unexpected admin users, or modified files. Organizations in scope for CISA BOD 26-04 must apply the required mitigations per vendor instructions or discontinue use. | 9.8 group max | 97% | KEV PoC |
| massest. hundreds of thousands to millions of WordPress sites (core runs roughly 40% of the web; only unpatched 6.9.x/7.0.x instances remain exploitable) |
Full article386 words · extracted from securityaffairs.com · click to collapse
Public exploits are now available for two critical WordPress flaws that attackers can chain to gain remote code execution without authentication.
Public proof-of-concept exploits are now available for the critical wp2shell vulnerabilities affecting WordPress Core. The flaws, tracked as CVE-2026-63030 and CVE-2026-60137, can be chained to achieve pre-authentication remote code execution on default WordPress installations running versions 6.9.x and 7.0.x.
CVE-2026-63030 is a REST API batch-route confusion bug introduced in WordPress 6.9. CVE-2026-60137 is a high-severity SQL injection flaw in the author__not_in parameter of WP_Query, affecting.
“The 7.0.2 security release addresses one critical and one high severity security issue.” reads the WordPress announcement.
“Because this is a security release, it is recommended that you update your sites immediately. Due to the severity, the WordPress.org team have enabled forced updates via the auto-update system for sites running affected versions.”
Cybersecurity researchers at Searchlight Cyber discovered the flaws that can allow remote attackers to compromise vulnerable sites without valid credentials, making immediate patching essential.
“Searchlight Cyber’s security research team has discovered a pre-authentication RCE in WordPress Core. The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins.” reads the advisory. “It is estimated that over 500 million websites use WordPress.”
Researchers withheld technical details to give organizations time to patch, but released an online tool to help administrators check whether their WordPress instances are vulnerable.
Searchlight Cyber’s security research team estimated that over 500 million websites use WordPress. They are releasing a checker so admins can determine whether their instance is vulnerable.
WordPress has enabled forced automatic security updates for affected supported versions because of the severity of the flaws. The full RCE exploit chain affects WordPress versions 6.9.0–6.9.4 and 7.0.0–7.0.1, according to WordPress security advisories.
Site owners should update immediately to WordPress 7.0.2 or 6.9.5, which prevent the exploitation of the wp2shell attack chain.
If patching is not possible, administrators can temporarily reduce risk by blocking anonymous access to the REST API batch endpoint through a security plugin or WAF rules targeting /wp-json/batch/v1 and ?rest_route=/batch/v1.
Searchlight states that these measures are only temporary and may affect legitimate site functions, so updating remains the preferred solution.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/195597/hacking/attackers-can-take-over-wordpress-sites-using-newly-released-wp2shell-exploits.html