Flash Alert: wp2shell — Pre-Auth RCE in WordPress Core (CVE-2026-63030 / CVE-2026-60137)

Executive Summary

wp2shell is a pre-authentication remote code execution (RCE) chain in WordPress Core, disclosed on 17 July 2026 by Adam Kues of Assetnote (Searchlight Cyber) via WordPress's HackerOne program. It chains two flaws — CVE-2026-63030 (a REST API batch-route confusion bug) and CVE-2026-60137 (a SQL injection in WP_Query's author__not_in parameter) — to let a completely anonymous attacker run code on a default WordPress installation with no login, no plugins, and no non-default configuration. Multiple public proof-of-concept exploits are circulating and watchTowr has reported the first signs of exploitation in the wild. WordPress shipped emergency fixes and took the rare step of forcing automatic updates. ThreatIntel BD assesses this as a critical, immediately actionable threat to Bangladesh's web estate, given the country's heavy reliance on WordPress.

Risk Assessment

Assessed severity: Critical (4). This rating uses published CVSS v3.1 base scores from the vendor advisories and CyCognito's Emerging Threat analysis.

Component scores:

• CVE-2026-60137 — CVSS v3.1 9.1 (Critical), CWE-89 (SQL injection). The higher-severity half of the chain and the code path that turns unauthenticated reach into code execution.
• CVE-2026-63030 — CVSS v3.1 7.5 (High), CWE-436 (interpretation conflict). The REST API batch-route confusion that provides the pre-authentication reach.
• Chained outcome — pre-authentication RCE. CyCognito published an Emerging Threat Advisory for the pair on 19 July 2026; a full-mechanism proof of concept was public as of 18 July 2026, lowering the effort to probe exposed installs.
• Mitigation status. Patched in 6.8.6 / 6.9.5 / 7.0.2 with forced auto-updates for auto-update-enabled sites — but a background update can fail or be disabled, so confirm the installed version on each site rather than assuming remediation.

Vulnerability Details

• CVE-2026-63030 — REST API batch-route confusion (CWE-436), CVSS 7.5 (High). The batch endpoint /wp-json/batch/v1 has shipped since WordPress 5.6, but the confusion is only reachable as an unauthenticated RCE entry point when chained on 6.9 and later.
• CVE-2026-60137 — SQL injection in author__not_in (CWE-89), CVSS 9.1 (Critical). Present in WP_Query from WordPress 6.8 onward; chained behind the batch-route bug to reach code execution. A public PoC can read the database, including admin password hashes.

Affected and fixed versions:

• Full RCE chain: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 — fixed in 6.9.5 and 7.0.2 (released 17 July 2026); also fixed in 7.1 Beta 2.
• SQL injection only (no RCE path): WordPress 6.8.0–6.8.5 — fixed in 6.8.6. The batch route that turns the injection into RCE does not exist before 6.9.

Exploitation Status

• Multiple public proof-of-concept exploits have been published on GitHub in several forms since the patch dropped.
• watchTowr (CEO Benjamin Harris) reported the first signs of in-the-wild exploitation. Treat any unpatched, internet-facing install as a live target.
• WordPress enabled forced automatic security updates across affected supported installs — a measure reserved for crisis-level bugs. Forced updates may not reach sites that explicitly disabled auto-updates, so verify the patch actually applied.
• Searchlight published a checker at wp2shell[.]com (reported intermittently returning 404). Prefer version-based verification over third-party checkers.

Bangladesh Exposure

WordPress is the dominant CMS across Bangladeshi small businesses, newsrooms, universities, NGOs, and agency-built government-adjacent sites — many self-hosted on local providers with inconsistent patch discipline and auto-updates frequently disabled. These are precisely the installs least likely to receive the forced update and most likely to be caught by automated mass exploitation. Compromised WordPress sites are routinely repurposed for phishing, malware staging, SEO spam, and botnet command-and-control — activity ThreatIntel BD tracks directly, and which tends to spike after a mass-exploitable core bug like this one.

CyCognito's scan data reinforces the pattern: observed exposure is spread flatly across sectors — led by Consumer Discretionary (18.6%), Industrials (15.8%), and Communication Services (13.0%), with more than half of assets outside the top three — reflecting how widely and loosely WordPress is deployed rather than any single industry being targeted. The vulnerable asset is rarely the flagship domain; it is usually a secondary, campaign, or subsidiary site that has drifted out of inventory.

Detection & Threat Hunting

• Version fingerprinting is the safest first pass. A public passive Nuclei template (id CVE-2026-63030) reads the generator meta tag, RSS/OPML generators, and core asset ?ver= strings to flag installs in the 6.9.0–6.9.4 / 7.0.0–7.0.1 range without sending exploit traffic — safe against production.
• In web/access logs, hunt for anonymous requests to the batch endpoint — /wp-json/batch/v1 and the querystring form ?rest_route=/batch/v1 — especially POSTs from unfamiliar sources, and for requests referencing the author__not_in parameter.
• Post-exploitation signs: unexpected PHP files in uploads/theme/plugin directories, new admin users, modified core files, outbound connections to unknown hosts, and unexplained cron/scheduled-task changes.
• Cloudflare noted the vulnerable code path is reachable when a persistent object cache is not in use — installs without object caching warrant extra scrutiny.

Mitigation & Response

• Patch now. Update to WordPress 7.0.2, 6.9.5, or 6.8.6 as appropriate for your branch. This is the vendor-preferred remediation.
• Verify the update actually applied (Dashboard → Updates, or the version in the admin footer), particularly on sites that had auto-updates disabled.
• If you cannot patch immediately, block anonymous access to the batch endpoint at the WAF — both /wp-json/batch/v1 and ?rest_route=/batch/v1 — as a temporary measure only. It may break legitimate functionality and is not a substitute for patching.
• If compromise is suspected: isolate the host, preserve logs, rotate all secrets (database, admin, API, and anything stored in wp-config or the database), assume full server compromise for a stock install, and rebuild from a known-good backup rather than cleaning in place.
• Maintain an inventory of every internet-facing WordPress instance — the sites that get hit are usually the ones nobody remembered were online.

References

CyCognito Emerging Threat Advisory (CVE-2026-63030, CVE-2026-60137), 19 July 2026; Searchlight Cyber / Assetnote disclosure (wp2shell); WordPress 7.0.2 / 6.9.5 / 6.8.6 security releases; Rapid7, SOCRadar, BleepingComputer, The Hacker News, watchTowr, Cloudflare, and Aikido Intel reporting. Published CVSS v3.1: CVE-2026-60137 = 9.1 (Critical, CWE-89); CVE-2026-63030 = 7.5 (High, CWE-436).