Story · 1 source · 1 articlefirst Sep 7, 14:13 UTCupdated Sep 7, 14:13 UTC (8d ago)

WordPress "wp2shell" Pre-Auth RCE Chain (CVE-2026-63030 + CVE-2026-60137) Exploited in the Wild; CISA Sets July 24 Patching Deadline

criticalExploit / PoCexploited in the wildimportance 92CVE-2026-63030 CVE-2026-60137

What's new: First merged summary for this story (no previous summary existed). Key developments across the three reports: public PoC code emerged and exploitation was confirmed; CISA added both CVEs to KEV with a July 24, 2026 deadline; WordPress.org enabled forced auto-updates; fixes shipped in 6.8.6, 6.9.5, and 7.0.2; Cloudflare deployed WAF rules at 17:03 UTC July 17; Eye Security published forensic IR…

Merged summary · glm-5.3-flash · rewritten as coverage arrives

A chain of CVE-2026-63030 (WordPress REST API batch-route confusion) and CVE-2026-60137 (SQL injection in WP_Query's author__not_in) enables unauthenticated RCE on default WordPress installs. Disclosed July 17, 2026, both CVEs are on CISA's KEV catalog with a…

The "wp2shell" chain combines a REST API batch-endpoint route-confusion bug (CVE-2026-63030) with a SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137), escalating from pre-authentication SQLi to rogue admin creation and code execution via a malicious webshell plugin on default installs. The flaw was discovered by Adam Kues of Searchlight Cyber and disclosed by WordPress on July 17, 2026. Public PoCs on GitHub dump password hashes, crack admin credentials, and deploy a malicious plugin. CISA added both CVEs to the KEV catalog after confirmed exploitation, setting a July 24, 2026 patching deadline. Reports disagree on the affected range: one report describes the chain as affecting versions 6.8.0-7.0.1, while another states 6.8.0-6.8.5 is exposed to the SQLi only and 6.9.0-6.9.4 and 7.0.0-7.0.1 are exposed to full RCE. All reports agree fixes shipped in 6.9.5 and 7.0.2, and two reports also cite 6.8.6. WordPress.org enabled forced auto-updates (covering an estimated 200M+ sites, of the 500M+ sites WordPress powers), which likely protected most sites, but pre-patch compromises persist. Mitigations include blocking anonymous access to /wp-json/batch/v1 and ?rest_route=/batch/v1 or deploying Cloudflare managed WAF rules (deployed 17:03 UTC July 17). Eye Security released a compromise-scanner WordPress plugin and browser extension, noting database artifacts (oEmbed cache rows, changesets) are the primary evidence since the attack is log-blind and uses dozens of batch POSTs; Qualys detection is available via QIDs 531916, 531867, 734738, and 734739.

Chained vulnerabilities: CVE-2026-63030 (REST API batch-route confusion) + CVE-2026-60137 (SQL injection in WP_Query's author__not_in) yield unauthenticated RCE on default installs
Discovered by Adam Kues of Searchlight Cyber; disclosed by WordPress on July 17, 2026
Affected versions: one report says 6.8.0-7.0.1; another says 6.8.0-6.8.5 exposed to SQLi only and 6.9.0-6.9.4 and 7.0.0-7.0.1 exposed to full RCE (sources disagree)
Fixed versions: 6.9.5 and 7.0.2 per all reports; 6.8.6 per two of three reports
CISA added both CVEs to the KEV catalog after confirmed active exploitation, with a July 24, 2026 patching deadline
Public PoCs on GitHub dump password hashes, crack admin credentials, and upload a malicious/webshell plugin; exploit uses dozens of batch POSTs
WordPress.org enabled forced auto-updates across an estimated 200M+ sites; WordPress powers 500M+ sites in total
Full RCE chain may not trigger on sites using persistent object caches (Redis/Memcached)

Coverage timelineoldest first · each row is one article

Sep 7, 14:13 UTC · 8d ago
Web discovery (articles for new exploits & KEV entries)· 92
WordPress wp2shell Vulnerabilities Exploited in the Wild (CVE-2026 ...
Public exploit code emerged for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137); CISA set a July 24 patching deadline.

Vulnerabilities in this storyAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-63030 +1 in the same advisory: …60137	WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE WordPress Core contains an interpretation-conflict flaw (CWE-436) in the REST API batch endpoint that causes route confusion, allowing requests to be dispatched to an unintended route. When chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), this allows a remote, unauthenticated attacker to inject SQL and escalate to remote code execution. Any WordPress site running 6.9.x before 6.9.5 or 7.0.x before 7.0.2 is affected, with no privileges or user interaction required (CVSS 3.1: 9.8). Exploitation is confirmed in the wild: the issue was added to CISA's KEV on 2026-07-21, EPSS is 97.3% (100th percentile), and a public PoC is reportedly fueling mass scanning under the 'wp2shell' label. Do: Upgrade immediately to WordPress 6.9.5 (for 6.9.x) or 7.0.2 (for 7.0.x), or later, which fixes both this flaw and the chained SQL injection CVE-2026-60137; prioritize internet-facing sites because exploitation is unauthenticated and being mass-scanned. Review web and REST API logs for suspicious batch requests, SQL errors, unexpected admin users, or modified files. Organizations in scope for CISA BOD 26-04 must apply the required mitigations per vendor instructions or discontinue use.	9.8 group max	97%	KEV PoC	WordPress Core 6.9.x before 6.9.5 WordPress Core 7.0.x before 7.0.2	massest. hundreds of thousands to millions of WordPress sites (core runs roughly 40% of the web; only unpatched 6.9.x/7.0.x instances remain exploitable)	Jul 17, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-63030

+1 in the same advisory: …60137

WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE

WordPress Core contains an interpretation-conflict flaw (CWE-436) in the REST API batch endpoint that causes route confusion, allowing requests to be dispatched to an unintended route. When chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), this allows a remote, unauthenticated attacker to inject SQL and escalate to remote code execution. Any WordPress site running 6.9.x before 6.9.5 or 7.0.x before 7.0.2 is affected, with no privileges or user interaction required (CVSS 3.1: 9.8). Exploitation is confirmed in the wild: the issue was added to CISA's KEV on 2026-07-21, EPSS is 97.3% (100th percentile), and a public PoC is reportedly fueling mass scanning under the 'wp2shell' label.

Do: Upgrade immediately to WordPress 6.9.5 (for 6.9.x) or 7.0.2 (for 7.0.x), or later, which fixes both this flaw and the chained SQL injection CVE-2026-60137; prioritize internet-facing sites because exploitation is unauthenticated and being mass-scanned. Review web and REST API logs for suspicious batch requests, SQL errors, unexpected admin users, or modified files. Organizations in scope for CISA BOD 26-04 must apply the required mitigations per vendor instructions or discontinue use.

9.8

group max

97%

KEV PoC

WordPress Core 6.9.x before 6.9.5
WordPress Core 7.0.x before 7.0.2

massest. hundreds of thousands to millions of WordPress sites (core runs roughly 40% of the web; only unpatched 6.9.x/7.0.x instances remain exploitable)

Jul 17, 2026