"WP2Shell" Critical WordPress RCE Chain (CVE-2026-63030 & CVE-2026-60137)
CISA added the WordPress core pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137) to KEV after confirmed exploitation; WordPress 6.9.5 and 7.0.2 fix the flaws.
On July 17, 2026 WordPress disclosed CVE-2026-63030, a REST API route-confusion flaw, and CVE-2026-60137, a SQL injection in WP_Query, which chain to unauthenticated remote code execution on default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. CISA has added both to the Known Exploited Vulnerabilities Catalog and active exploitation is confirmed. Cloudflare deployed WAF rules at 17:03 UTC on July 17, and patches are available in WordPress 6.9.5 and 7.0.2.
- Chain: REST API route confusion (CVE-2026-63030) plus SQLi (CVE-2026-60137) yields pre-auth RCE
- CISA added both CVEs to the KEV catalog after confirmed exploitation
- Mitigations: block anonymous REST API access or deploy Cloudflare managed WAF rules
- WordPress 6.8.0-6.8.5 exposed to SQLi only; 6.9.0-6.9.4 and 7.0.0-7.0.1 to full RCE
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-63030 +1 in the same advisory: …60137 | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE WordPress Core contains an interpretation-conflict flaw (CWE-436) in the REST API batch endpoint that causes route confusion, allowing requests to be dispatched to an unintended route. When chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), this allows a remote, unauthenticated attacker to inject SQL and escalate to remote code execution. Any WordPress site running 6.9.x before 6.9.5 or 7.0.x before 7.0.2 is affected, with no privileges or user interaction required (CVSS 3.1: 9.8). Exploitation is confirmed in the wild: the issue was added to CISA's KEV on 2026-07-21, EPSS is 97.3% (100th percentile), and a public PoC is reportedly fueling mass scanning under the 'wp2shell' label. Do: Upgrade immediately to WordPress 6.9.5 (for 6.9.x) or 7.0.2 (for 7.0.x), or later, which fixes both this flaw and the chained SQL injection CVE-2026-60137; prioritize internet-facing sites because exploitation is unauthenticated and being mass-scanned. Review web and REST API logs for suspicious batch requests, SQL errors, unexpected admin users, or modified files. Organizations in scope for CISA BOD 26-04 must apply the required mitigations per vendor instructions or discontinue use. | 9.8 group max | 97% | KEV PoC |
| massest. hundreds of thousands to millions of WordPress sites (core runs roughly 40% of the web; only unpatched 6.9.x/7.0.x instances remain exploitable) |
Full article623 words · extracted from labs.beazley.security · click to collapse
Executive Summary
Update: July 21, 2026: CISA has added CVE-2026-63030 and CVE-2026-60137 to its Known Exploited Vulnerabilities (KEV) Catalog. WordPress disclosed CVE-2026-60137 and CVE-2026-63030 together on July 17, active exploitation has now been confirmed for both CVEs. Organizations using WordPress should treat this as a critical, actively exploited vulnerability and prioritize patching.
On July 17th, WordPress disclosed two separate vulnerabilities which when chained together, could enable a remote unauthenticated attacker to achieve Remote Code Execution on default installations of the WordPress “core” product. The vulnerabilities include CVE-2026-63030, a flaw in the REST API which can be paired with a SQL Injection vulnerability, CVE-2026-60137 in order to achieve Remote Code Execution.
The vulnerability was discovered by a researcher at Searchlight, and Beazley Security is not aware of any in the wild exploitation of this vulnerability at the time of writing. Additionally, there are currently no publicly available proof-of-concept exploits available, and Searchlight did not provide enough technical details to easily create one. WordPress made patches available before public disclosure, and Cloudflare simultaneously released Web Application Firewall (WAF) protections for sites behind its service.
Given the widespread use of WordPress, the presence of the vulnerability in the core software, and the apparent ease of exploitation, Beazley Security expects threat actors to reverse engineer patchesand attempt to exploit WordPress installations at scale. Beazley Security strongly recommends organizations apply available patches immediately, or deploy mitigations such as WAF rules.
Affected Systems or Products
Product | Affected Version | Fixed Version |
WordPress 6 | 6.9.0 – 6.9.4 | 6.9.5 |
WordPress 7 | 7.0.0 – 7.0.1 | 7.0.2 |
Versions before 6.9.0 are not affected.
Mitigations / Workarounds
If security update patches cannot be immediately applied, the following recommended mitigations were provided for this specific vulnerability:
Block anonymous access to the rest API, this can be achieved with plugins like Disable WP REST API, which are available on the official WordPress Plugin Directory.
Block traffic to the web endpoints
/wp-json/batch/v1and?rest_route=/batch/v1via a Web Application Firewall (WAF).Cloudflare has deployed new WAF rules to protect all customers, including those on free and paid plans, if their application traffic is proxied through the Cloudflare WAF. The rules were reportedly deployed at 17:03 UTC on July 17, 2026.
Technical Details
At the time of publication, WordPress provided limited technical information about the critical vulnerabilities in its security release. However, Cloudflare published a concurrent advisory announcing new Web Application Firewall (WAF) protections for both critical vulnerabilities and additional technical analysis.
According to Cloudflare, CVE-2026-60137 is a SQL injection vulnerability affecting WordPress 6.8 and later, while CVE-2026-63030 is an unauthenticated remote code execution vulnerability affecting WordPress 6.9 and later. The RCE vulnerability is directly related to the SQL injection flaw and can be exploited through the REST API batch endpoint when a persistent object cache is not enabled.
The root cause lies in a route confusion condition within the REST API Batch Endpoint that causes attacker-controlled input to be misrouted or interpreted incorrectly. This allows crafted requests to reach unintended code paths, ultimately triggering the SQL injection vulnerability and providing a path to remote code execution.
Beazley Security recommends organizations upgrade to the latest supported version of WordPress as soon as possible, prioritizing patching of internet facing instances of the software. Organizations leveraging Cloudflare should ensure the latest managed WAF rules are enabled.
How Beazley Security is responding
Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.
We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.
If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.
Appendix
Sources
Text extracted automatically; images, tables and formatting may be missing. Original: https://labs.beazley.security/advisories/BSL-A1193