Unauthenticated attackers exploit WP2Shell vulnerabilities to achieve remote code execution on WordPress websites

Summary

Two newly discovered vulnerabilities in the WordPress core are being exploited in the wild, allowing attackers to achieve unauthenticated remote code execution (RCE). The flaws, referred to as "WP2Shell," involve a combination of an SQL injection vulnerability and a REST API batch endpoint route confusion issue.

Exploitation attempts have already been observed by security firms including Patchstack, Hexastrike, and WatchTowr. Because the attack requires no preconditions-meaning it can work on a standard WordPress installation with no additional plugins-the potential impact is widespread across millions of sites.

Technical details

The vulnerability chain consists of two distinct flaws that, when combined, grant full control over a targeted site.

First, CVE-2026-60137 is an SQL injection flaw where the author__not_in parameter of WP_Query fails to properly sanitize input. This allows crafted database queries to be injected into the system. While this vulnerability affects WordPress versions 6.8 and higher, it does not lead directly to code execution on its own.

Second, CVE-2026-63030 is a critical issue involving route confusion within the REST API batch endpoint. When an attacker chains this with the SQL injection mentioned above, they can achieve unauthenticated remote code execution. This specific RCE path is present in WordPress versions 6.9 and higher, particularly when a persistent object cache is not in use.

Affected products and fixed versions

The vulnerabilities affect different versions of the WordPress core depending on whether you are looking at the SQL injection or the full RCE chain.

Versions earlier than 6.8 are not affected by these specific flaws.

Exploitation status

Exploitation is currently active in the wild. Security researchers at Searchlight Cyber discovered the flaws, and while they have not released public details to prevent further abuse, other actors have already published proof-of-concept (PoC) exploits.

The window between disclosure and weaponization has collapsed; researchers noted that PoCs appeared within hours of the vulnerability becoming known. Hexastrike reported seeing exploitation attempts in honeypots over the weekend, and by Sunday, they were assisting with incident response for several successful attacks.

Detection opportunities

Cloudflare has deployed specific Web Application Firewall (WAF) rules to intercept these attacks at two different points in the request path: one targeting the SQL injection parameter values and another targeting the REST API RCE path.

The following signatures are used for detection:

Wordpress - SQL Injection - CVE-2026-60137

1c060d3a371549219ee290d7ed933fcc
db003b39b7774859a8d588ce33697a1a

Wordpress - Remote Code Execution - CVE-2026-63030

7dfb2bd4708d4b88b9911dc0550664b6
ebd3f2df15c74ddcbf6220c9b5ec246a

Defender guidance

The WordPress.org team has enabled forced updates via the auto-update system for affected sites due to the extreme severity of these flaws.

1. Verify your version: Check your WordPress dashboard to ensure you are running a patched version (7.0.2, 6.9.5, or 6.8.6).
2. Manual Update: If auto-updates have not triggered, navigate to the "Updates" section of your dashboard and click "Update Now."
3. WAF Configuration: If you use Cloudflare, ensure that Managed Rules are enabled and that these specific rules are set to "Block" rather than "Log."
4. Monitor Logs: Review your security logs for suspicious requests hitting the REST API endpoints, especially if you do not typically use those features.