WP2Shell: WordPress Core Pre-Auth RCE Chain (CVE-2026-63030, CVE-2026-60137) Added to CISA KEV Amid Confirmed Exploitation

CISA added the WP2Shell WordPress core pre-auth RCE chain — REST API route confusion (CVE-2026-63030) chained with WP_Query SQL injection (CVE-2026-60137) — to its Known Exploited Vulnerabilities Catalog after confirmed exploitation; WordPress.org forced…

On July 17, 2026 WordPress disclosed a critical unauthenticated RCE chain affecting default installs: CVE-2026-63030, a REST API batch-endpoint route-confusion flaw, chained with CVE-2026-60137, a SQL injection in WP_Query's author__not_in parameter. Together they allow unauthenticated attackers to create rogue admin accounts and achieve code execution via a webshell plugin. WordPress 6.8.0–6.8.5 are exposed to the SQLi only, while 6.9.0–6.9.4 and 7.0.0–7.0.1 are vulnerable to the full RCE chain. Fixed versions are 6.8.6, 6.9.5, and 7.0.2 (per report 2; report 1 lists 6.9.5 and 7.0.2). CISA added both CVEs to the Known Exploited Vulnerabilities Catalog and active exploitation is confirmed. The flaw was discovered by Adam Kues of Searchlight Cyber, a public PoC exists on GitHub, and WordPress.org forced automatic updates across an estimated 200M+ sites, likely protecting most sites, though pre-patch compromises persist. Cloudflare deployed managed WAF rules at 17:03 UTC on July 17, and blocking anonymous REST API access is an additional mitigation; sites using persistent object caches (Redis/Memcached) may not trigger the full RCE chain. The exploit issues dozens of batch POSTs and is log-blind, so Eye Security notes database artifacts (oEmbed cache rows, changesets) are the primary forensic evidence, and released a compromise-scanner WordPress plugin and browser extension for incident response.