WordPress administrators should urgently patch two recently disclosed Core vulnerabilities collectively known as WP2Shell. When chained together, the flaws allow an unauthenticated attacker to execute code against affected WordPress installations without requiring a valid account, vulnerable plugin, user interaction or non-default configuration.
WordPress released emergency security updates on 17 July 2026 and enabled forced automatic updates for affected installations. Administrators should verify that the update completed successfully rather than assuming their websites are protected.
Summary
WP2Shell combines a REST API route-confusion vulnerability, tracked as CVE-2026-63030, with an SQL injection vulnerability in the WordPress query system, tracked as CVE-2026-60137.
The full exploit chain affects WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Successful exploitation can allow an attacker to compromise a WordPress website and potentially execute malicious code within the context of the web server.
Public proof-of-concept code appeared shortly after disclosure. By 19 July, there were more than two dozen distinct public PoCs, including implementations that reportedly achieved code execution without first cracking an administrator password.
Observed Threat Activity
Exploitation activity began shortly after the vulnerabilities were disclosed. Researchers classified CVE-2026-63030 as known to be exploited, with observed in-the-wild attempts following the publication of exploit code.
Because multiple PoCs and exploit variations are now circulating, attacks are unlikely to remain associated with a small or stable set of source IP addresses. Organisations should therefore prioritise endpoint, request and post-exploitation behaviours rather than relying exclusively on static indicators.
Technical Analysis
WP2Shell is an exploit chain involving two separate weaknesses in WordPress Core.
CVE-2026-63030 is a critical route-confusion vulnerability affecting the WordPress REST API batch endpoint. The weakness can allow an unauthenticated request to reach functionality that should otherwise be restricted.
The vulnerability affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. WordPress states that, when combined with CVE-2026-60137, it can lead to remote code execution. 2026-60137: WP_Query SQL Injection
CVE-2026-60137 is an SQL injection vulnerability affecting the author__not_in parameter of the WordPress WP_Query class. The parameter was not sufficiently sanitised before being incorporated into a database query under vulnerable conditions.
The SQL injection issue affects WordPress 6.8.0 through 6.8.5, 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1. On the 6.8 branch, the vulnerability does not form the complete WP2Shell RCE chain because the associated REST API route-confusion issue was introduced in WordPress 6.9. oit Chain
CVE-2026-63030 allows the attacker to reach the vulnerable query path without authentication. CVE-2026-60137 can then be used to manipulate a database query, creating a path toward data extraction and code execution.
Affected Versions
| WordPress version | Exposure | Required action |
| Earlier than 6.8 | Not affected by these vulnerabilities | Continue normal security maintenance |
| 6.8.0–6.8.5 | Affected by CVE-2026-60137 SQL injection | Update to 6.8.6 or later |
| 6.9.0–6.9.4 | Affected by the complete WP2Shell RCE chain | Update to 6.9.5 or later |
| 7.0.0–7.0.1 | Affected by the complete WP2Shell RCE chain | Update to 7.0.2 or later |
| 7.1 beta releases before beta 2 | Affected by both vulnerabilities | Update to 7.1 beta 2 or later |
WordPress has enabled forced automatic updates for affected supported versions, but websites with failed updates, restricted filesystem permissions, disabled background updates or unsupported hosting configurations may remain exposed. Administrators must verify the installed Core version directly.
Impact
Successful exploitation could allow an attacker to take control of an affected WordPress website and execute code within the privileges assigned to the web server process.
Possible consequences include:
- Extraction or modification of WordPress database contents
- Theft of administrator credentials and password hashes
- Creation of unauthorised administrator accounts
- Installation of malicious plugins, themes or PHP web shells
- Modification of legitimate WordPress Core or website files
- Theft of customer, subscriber or e-commerce data
- Injection of malicious JavaScript, redirects or payment skimmers
- Use of the compromised website for phishing or malware distribution
- Theft of database credentials and other secrets stored in configuration files
- Lateral movement into connected infrastructure where hosting permissions allow it
Detection and Threat Hunting
Organisations should review recent web, WAF, CDN, application and server logs.
Web and WAF Activity
Search for unexpected or repeated requests involving the WordPress REST API batch endpoints:
- /wp-json/batch/v1
- /?rest_route=/batch/v1
Particular attention should be given to unauthenticated POST requests, unusual request bodies, repeated requests from the same source, abnormal response sizes and requests immediately followed by administrative activity or changes to the website.
Admins should confirm that the rules remain set to Block, review any ruleset overrides and inspect Security Events for matching requests. WAF protection reduces exposure but does not remediate the vulnerable WordPress installation. Press Activity
Review WordPress and database records for:
- Recently created administrator accounts
- Unexpected changes to existing account passwords or email addresses
- Unauthorised plugin or theme installations
- Recently activated plugins that are not part of the approved baseline
- Changes to WordPress configuration or security settings
- Suspicious scheduled actions or WordPress cron jobs
- Unexplained changes to posts, templates, widgets or redirect settings
Host-Level Activity
Inspect the underlying server for:
- Newly created or recently modified PHP files
- PHP files within upload, cache or temporary directories
- Unrecognised files under wp-content/plugins, wp-content/themes or wp-content/mu-plugins
- Modifications to WordPress Core files
- Processes launched by the web server or PHP runtime
- Unexpected outbound connections from the web server
- New operating-system users, SSH keys, cron entries or scheduled tasks
- Changes to .htaccess, web server configuration or PHP configuration files
Administrators should compare the website against a known-good backup or file-integrity baseline. Updating WordPress does not remove persistence established before the patch was applied.
Recommended Actions
- Update WordPress immediately. Upgrade affected 7.0 installations to version 7.0.2 or later, 6.9 installations to 6.9.5 or later, and 6.8 installations to 6.8.6 or later.
- Verify the installed version. Do not rely solely on WordPress’ forced automatic update process. Confirm the running Core version through the administrative dashboard, hosting platform, command line or asset-management system.
- Apply temporary WAF restrictions where immediate patching is impossible. Block unauthenticated access to /wp-json/batch/v1 and ?rest_route=/batch/v1, or temporarily restrict anonymous REST API access. These controls may disrupt legitimate functionality and should only be used until the security update can be applied. duct a compromise assessment.** Review WAF, HTTP access, WordPress, database and operating-system logs for exploitation attempts and post-exploitation activity. The presence of a patched version does not prove that the website was not compromised before updating.
- Strengthen ongoing WordPress security. Restrict administrative access, enforce multifactor authentication, disable unnecessary plugin installation, maintain tested backups, use file-integrity monitoring and place internet-facing WordPress sites behind a properly configured WAF.
How OP Innovate Can Help
OP Innovate supports organisations in identifying exposed WordPress assets, validating patch deployment, reviewing WAF and application logs, conducting compromise assessments and investigating suspected web-server intrusions.
Where exploitation is confirmed, our incident-response specialists can help contain the affected infrastructure, identify persistence, determine the scope of unauthorised access and support secure recovery.
Contact OP Innovate for assistance assessing or responding to potential WP2Shell exploitation.
Stay Safe. Stay Secure.
OP Innovate Research Team
