Unauthenticated attackers achieve remote code execution when chaining two flaws in WordPress core (wp2shell)

b.s 1
Viewed 2

Two vulnerabilities in WordPress core can be chained by an unauthenticated attacker to achieve full remote code execution on a default, stock installation with no plugins and no login required — dubbed "wp2shell." A REST API batch-route confusion bug (CVE-2026-63030) disables an authorization check on the /wp-json/batch/v1 endpoint, allowing a recursive batch call to reach a SQL injection flaw in the author__not_in parameter of WP_Query (CVE-2026-60137) that would otherwise require a logged-in user. The resulting UNION-based SQL injection is escalated to create an administrator account, after which the attacker logs in and uploads a malicious plugin to execute code.

Discoverer Adam Kues (Assetnote/Searchlight Cyber) reportedly used OpenAI's GPT-5.6 to find the chain in about 10 hours, and mass exploitation began within hours of the patch's public disclosure, with proof-of-concept exploits reproduced quickly using frontier AI models.

Approximately 60% of organizations running WordPress had at least one exposed instance when the flaws went public. WordPress co-founder Matt Mullenweg described it as a pre-authentication takeover seen only a few times in the software's 23-year history.

Steps to reproduce:

  1. Target an unpatched WordPress core installation (versions 6.9.0–6.9.4 or 7.0.0–7.0.1).
  2. Send a recursive batch call to the REST API batch endpoint (/wp-json/batch/v1) to bypass the GET-only authorization restriction (CVE-2026-63030).
  3. Use the resulting access to reach the author__not_in parameter of WP_Query and perform pre-authentication UNION-based SQL injection (CVE-2026-60137).
  4. Escalate the SQL injection to create an administrator account.
  5. Log in as the newly created administrator and upload a malicious plugin to achieve remote code execution.

Workaround: None documented beyond immediate patching; the vulnerability chain has no preconditions and affects stock installations.

Severity: Critical (unauthenticated, no user interaction required, results in full remote code execution and site takeover; officially rated CVSS 9.8 and described by WordPress's co-founder as a rare pre-authentication takeover; actively mass-exploited in the wild)
First seen: 2026-07-17
Affected product: WordPress
Affected platforms: All platforms (server-side WordPress core, independent of hosting OS)
Affected versions: WordPress core 6.9.0–6.9.4 and 7.0.0–7.0.1 (full RCE chain); 6.8.x and later also exposed to the SQL injection component (CVE-2026-60137) alone
Fixed versions: WordPress 6.8.6, 6.9.5, and 7.0.2

Links:

wordpress security
1 Answers

Update to WordPress 7.0.2 (from the 7.0.x branch) or 6.9.5 (from the 6.9.x branch), both released July 17, 2026.

Sites on the 6.8.x branch, exposed to the SQL injection component alone, should update to 6.8.6. WordPress forced automatic updates to all supported installations via its auto-update system due to the severity.

b.s1
Related
Unauthenticated attackers achieve remote code execution when chaining two flaws in WordPress core (wp2shell)
1 solutions