Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication
Seqrite details WP2Shell, an unauthenticated WordPress chain combining two core flaws into remote code execution.
Seqrite researcher Amruta Wagh describes WP2Shell, a chain of two WordPress Core flaws that can lead to unauthenticated remote code execution. CVE-2026-63030 confuses REST API batch routing so unauthenticated callers can reach protected handlers, and CVE-2026-60137 is SQL injection through the posts endpoint’s author_exclude parameter. The reported lab sequence creates an administrator and installs a malicious plugin containing a web shell. The full chain affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1; 6.8.6, 6.9.5, and 7.0.2 are listed as fixed, and the report does not establish widespread exploitation.
- WP2Shell chains REST API route confusion with SQL injection for unauthenticated code execution.
- CVE-2026-63030 affects the batch REST controller; CVE-2026-60137 is SQL injection via author_exclude.
- Full chain hits WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1; fixes are 6.8.6, 6.9.5, and 7.0.2.
- Lab proof-of-concept creates an administrator and installs a plugin web shell; widespread exploitation is not established.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-63030+1 related CVE | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE | 9.8 group max | 11% | KEVPoC ×7 | KEV |
From the original article
2 min read at gbhackers.com
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to analysis by Seqrite researcher Amruta Wagh. Dubbed WP2Shell, the exploit chain reportedly emerged in July 2026 and combines REST API route confusion with SQL injection, allowing attackers to progress from public endpoints to server compromise without possessing valid WordPress credentials. […]
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.