Story · 1 source · 2 articlesfirst Sep 8, 16:27 UTCupdated Sep 8, 16:27 UTC (7d ago)1

WP2Shell: WordPress Core Pre-Auth RCE Chain (CVE-2026-63030, CVE-2026-60137) Added to CISA KEV Amid Confirmed Exploitation

criticalExploit / PoCexploited in the wildimportance 92CVE-2026-63030 CVE-2026-60137

What's new: First merged summary for this story (no previous summary). New developments combined from both reports: CISA added both CVEs to the KEV catalog following confirmed exploitation; WordPress.org forced auto-updates across an estimated 200M+ sites; Cloudflare deployed WAF rules; Eye Security released compromise-scanning IR tooling emphasizing database artifacts as primary evidence for detecting…

Merged summary · glm-5.3 · rewritten as coverage arrives

CISA added the WP2Shell WordPress core pre-auth RCE chain — REST API route confusion (CVE-2026-63030) chained with WP_Query SQL injection (CVE-2026-60137) — to its Known Exploited Vulnerabilities Catalog after confirmed exploitation; WordPress.org forced…

On July 17, 2026 WordPress disclosed a critical unauthenticated RCE chain affecting default installs: CVE-2026-63030, a REST API batch-endpoint route-confusion flaw, chained with CVE-2026-60137, a SQL injection in WP_Query's author__not_in parameter. Together they allow unauthenticated attackers to create rogue admin accounts and achieve code execution via a webshell plugin. WordPress 6.8.0–6.8.5 are exposed to the SQLi only, while 6.9.0–6.9.4 and 7.0.0–7.0.1 are vulnerable to the full RCE chain. Fixed versions are 6.8.6, 6.9.5, and 7.0.2 (per report 2; report 1 lists 6.9.5 and 7.0.2). CISA added both CVEs to the Known Exploited Vulnerabilities Catalog and active exploitation is confirmed. The flaw was discovered by Adam Kues of Searchlight Cyber, a public PoC exists on GitHub, and WordPress.org forced automatic updates across an estimated 200M+ sites, likely protecting most sites, though pre-patch compromises persist. Cloudflare deployed managed WAF rules at 17:03 UTC on July 17, and blocking anonymous REST API access is an additional mitigation; sites using persistent object caches (Redis/Memcached) may not trigger the full RCE chain. The exploit issues dozens of batch POSTs and is log-blind, so Eye Security notes database artifacts (oEmbed cache rows, changesets) are the primary forensic evidence, and released a compromise-scanner WordPress plugin and browser extension for incident response.

CVE-2026-63030: REST API batch-endpoint route-confusion flaw; CVE-2026-60137: SQL injection in WP_Query's author__not_in parameter
Chaining the two yields unauthenticated remote code execution on default WordPress installs, escalating from pre-auth SQLi to rogue admin and webshell plugin
Affected versions: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 (full RCE chain); 6.8.0–6.8.5 (SQLi only)
Fixed versions: 6.8.6, 6.9.5, and 7.0.2 per report 2; report 1 lists 6.9.5 and 7.0.2
CISA added both CVEs to the Known Exploited Vulnerabilities Catalog; active exploitation is confirmed
WordPress disclosed the flaws on July 17, 2026; discovered by Adam Kues of Searchlight Cyber; a public PoC exists on GitHub
WordPress.org forced automatic updates across an estimated 200M+ sites, likely protecting most sites, though pre-patch compromises persist
Cloudflare deployed managed WAF rules at 17:03 UTC on July 17, 2026

Coverage timelineoldest first · each row is one article

Sep 8, 16:27 UTC · 7d ago
Web discovery (articles for new exploits & KEV entries)· 92
"WP2Shell" Critical WordPress RCE Chain (CVE-2026-63030 & CVE-2026-60137)
CISA added the WordPress core pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137) to KEV after confirmed exploitation; WordPress 6.9.5 and 7.0.2 fix the flaws.
Sep 8, 16:27 UTC · 7d ago
Web discovery (articles for new exploits & KEV entries)· 90
wp2shell: incident response guide (CVE-2026-63030 + CVE-2026-60137)
Eye Security published forensic IR tooling for wp2shell (CVE-2026-63030/CVE-2026-60137), the unauthenticated WordPress core RCE chain, after WordPress.org forced auto-updates.

Vulnerabilities in this storyAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-63030 +1 in the same advisory: …60137	WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE WordPress Core contains an interpretation-conflict flaw (CWE-436) in the REST API batch endpoint that causes route confusion, allowing requests to be dispatched to an unintended route. When chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), this allows a remote, unauthenticated attacker to inject SQL and escalate to remote code execution. Any WordPress site running 6.9.x before 6.9.5 or 7.0.x before 7.0.2 is affected, with no privileges or user interaction required (CVSS 3.1: 9.8). Exploitation is confirmed in the wild: the issue was added to CISA's KEV on 2026-07-21, EPSS is 97.3% (100th percentile), and a public PoC is reportedly fueling mass scanning under the 'wp2shell' label. Do: Upgrade immediately to WordPress 6.9.5 (for 6.9.x) or 7.0.2 (for 7.0.x), or later, which fixes both this flaw and the chained SQL injection CVE-2026-60137; prioritize internet-facing sites because exploitation is unauthenticated and being mass-scanned. Review web and REST API logs for suspicious batch requests, SQL errors, unexpected admin users, or modified files. Organizations in scope for CISA BOD 26-04 must apply the required mitigations per vendor instructions or discontinue use.	9.8 group max	97%	KEV PoC	WordPress Core 6.9.x before 6.9.5 WordPress Core 7.0.x before 7.0.2	massest. hundreds of thousands to millions of WordPress sites (core runs roughly 40% of the web; only unpatched 6.9.x/7.0.x instances remain exploitable)	Jul 17, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-63030

+1 in the same advisory: …60137

WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE

WordPress Core contains an interpretation-conflict flaw (CWE-436) in the REST API batch endpoint that causes route confusion, allowing requests to be dispatched to an unintended route. When chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), this allows a remote, unauthenticated attacker to inject SQL and escalate to remote code execution. Any WordPress site running 6.9.x before 6.9.5 or 7.0.x before 7.0.2 is affected, with no privileges or user interaction required (CVSS 3.1: 9.8). Exploitation is confirmed in the wild: the issue was added to CISA's KEV on 2026-07-21, EPSS is 97.3% (100th percentile), and a public PoC is reportedly fueling mass scanning under the 'wp2shell' label.

Do: Upgrade immediately to WordPress 6.9.5 (for 6.9.x) or 7.0.2 (for 7.0.x), or later, which fixes both this flaw and the chained SQL injection CVE-2026-60137; prioritize internet-facing sites because exploitation is unauthenticated and being mass-scanned. Review web and REST API logs for suspicious batch requests, SQL errors, unexpected admin users, or modified files. Organizations in scope for CISA BOD 26-04 must apply the required mitigations per vendor instructions or discontinue use.

9.8

group max

97%

KEV PoC

WordPress Core 6.9.x before 6.9.5
WordPress Core 7.0.x before 7.0.2

massest. hundreds of thousands to millions of WordPress sites (core runs roughly 40% of the web; only unpatched 6.9.x/7.0.x instances remain exploitable)

Jul 17, 2026