WordPress Core Vulnerabilities: Two Critical Flaws Enable Pre-Authentication Remote Code Execution, Exposing Millions of Sites

An anonymous HTTP request can run code on a WordPress site, a critical vulnerability in the platform’s core that affects millions of installations worldwide. The bug, now designated as wp2shell, is comprised of two distinct but chained vulnerabilities that, when exploited together, allow unauthenticated attackers to achieve remote code execution (RCE). This discovery has prompted an urgent update from WordPress, with versions 6.9.5 and 7.0.2 released to address the critical security flaws. The forced update mechanism employed by WordPress aims to ensure widespread patching across its vast user base.

Unpacking the wp2shell Vulnerability: A Two-Pronged Attack

The wp2shell vulnerability is not a single exploit but rather a sophisticated combination of two distinct security weaknesses, each now carrying its own Common Vulnerabilities and Exposures (CVE) identifier. The first component, CVE-2026-63030, is a flaw within the REST API’s batch route handling. This vulnerability, discovered by Adam Kues at Assetnote, Searchlight Cyber’s attack surface management arm, allows for confusion in how batch requests are processed. The second, CVE-2026-60137, is a SQL injection vulnerability that exists within the WordPress core itself. This SQL injection was reported independently by multiple researchers, including TF1T, dtro, and haongo.

When chained together, these two vulnerabilities create a potent attack vector. An anonymous HTTP request can leverage the REST API batch route confusion to bypass authentication and access vulnerable parameters within the WordPress core. This then allows the SQL injection to be executed, ultimately leading to remote code execution on the targeted WordPress site. The implications are severe, as this means an attacker does not need any prior access or credentials to compromise a website.

Timeline of Discovery and Disclosure

The timeline leading up to the public disclosure and patching of wp2shell highlights a race between attackers and defenders.

• Early 2026: The SQL injection vulnerability (CVE-2026-60137) likely existed in WordPress core for an extended period, potentially dating back to version 6.8. Its discovery and reporting by multiple independent researchers occurred during this phase.
• May 2026: Adam Kues at Assetnote identified the REST API batch-route confusion (CVE-2026-63030). This discovery was reported responsibly through WordPress’s HackerOne program.
• June 2026: WordPress developers began working on a fix, acknowledging the severity of the chained vulnerabilities. The complexity of patching two intertwined bugs required careful consideration to avoid introducing new issues.
• July 12, 2026: WordPress released versions 6.9.5 and 7.0.2, which included the patches for both CVE-2026-63030 and CVE-2026-60137. Crucially, these releases also enabled WordPress’s forced update system for these specific security patches, aiming to rapidly deploy the fix to as many sites as possible.
• July 15, 2026: Following the release of the patched versions, the full technical mechanism of the wp2shell exploit was published online. This included a detailed write-up under the name "wp2shell" by Assetnote, outlining the attack chain with no preconditions and the ability for exploitation by anonymous users.
• July 16, 2026: A working proof-of-concept (PoC) exploit for wp2shell became publicly available on GitHub. This development significantly lowered the barrier to entry for potential attackers, making the vulnerability a more immediate threat.
• July 18, 2026 (Update): The article reflects the latest developments, confirming that both flaws now carry CVE IDs, the full mechanism has been published, a persistent object cache condition has been identified as a mitigating factor, and a working proof-of-concept is public.

Scope of Vulnerability and Affected Versions

The wp2shell vulnerability affects a significant portion of the WordPress ecosystem, particularly newer installations. The SQL injection (CVE-2026-60137) has a broader reach, impacting WordPress versions as far back as 6.8. However, the critical remote code execution aspect, which is the most alarming part of the exploit, is dependent on the presence of the REST API batch-route confusion (CVE-2026-63030). This latter vulnerability was introduced with WordPress version 6.9, meaning that the full RCE chain is only present in versions 6.9 and later.

Therefore, the critical RCE path is effectively limited to WordPress sites running version 6.9 or later, which were released after December 2, 2025. This implies that the most vulnerable sites are those that have been updated relatively recently. WordPress version 7.1 beta2 has been confirmed to carry both fixes. For sites running version 6.8, the SQL injection vulnerability still poses a risk of data access and manipulation, but not the full remote code execution. WordPress version 6.8.6 was released to patch the SQL injection in isolation for these older installations.

Searchlight Cyber’s research indicates that over 500 million websites globally utilize WordPress. While not all of these are necessarily vulnerable to the RCE component (due to the version dependency), the sheer scale of the WordPress user base means that a substantial number of sites remain at risk until they are updated.

Technical Breakdown of the Exploit Chain

The wp2shell exploit relies on a clever chaining of two distinct vulnerabilities:

1. SQL Injection in WP_Query: The SQL injection vulnerability resides within the WP_Query class, specifically in the author__not_in parameter. Normally, this parameter expects an array of author IDs to exclude. However, if a string is provided instead of an array, the validation check is bypassed, and the raw string value is directly incorporated into the SQL query. This allows an attacker to manipulate the query and potentially access sensitive data or, in conjunction with other vulnerabilities, execute arbitrary commands.

2. REST API Batch Route Confusion: The second crucial component is the REST API batch endpoint (/wp-json/batch/v1). This endpoint is designed to process multiple sub-requests within a single HTTP request, improving efficiency. It manages these sub-requests using two parallel arrays. The discovered flaw lies in an error condition within this batch processing. When an error occurs in one sub-request, it can cause the two parallel arrays to become desynchronized by one element. This misstep allows a subsequent request within the same batch to be processed by an unintended handler, effectively bypassing the endpoint’s intended security checks and allow-lists.

The Chain in Action: An anonymous attacker can send a specially crafted HTTP request to the /wp-json/batch/v1 endpoint. Within this request, they include a malicious payload targeting the author__not_in parameter. The batch route confusion allows this malicious input to bypass the endpoint’s security and reach the vulnerable WP_Query instance. Once the SQL injection is executed, an attacker can gain unauthorized access to the website’s database. In scenarios leading to RCE, this database access can be leveraged to further compromise the server.

The batch endpoint itself has been part of WordPress core since version 5.6, released in 2020. However, the specific confusion vulnerability that abuses it is a more recent addition, present only in version 6.9 and later.

Mitigating Factors and Conditions

While the wp2shell vulnerability presents a critical threat, there is one significant condition that can narrow its immediate impact: the presence of a persistent object cache.

• Persistent Object Cache: According to research published by Cloudflare, which has also released Web Application Firewall (WAF) rules to detect and block the exploit, the code-execution path of wp2shell functions only when a site is not running a persistent object cache, such as Redis or Memcached. A default WordPress installation typically does not include such a cache, meaning these sites are directly exposed to the RCE risk. However, sites that utilize these caching mechanisms may be shielded from this specific RCE vector. It is important to note that this mitigation does not protect against the SQL injection vulnerability (CVE-2026-60137) itself, which can still lead to data breaches even on sites with object caching.

Official Responses and Reactions

WordPress has responded with urgency to the discovery of these vulnerabilities. The immediate release of patched versions 6.9.5 and 7.0.2, coupled with the activation of forced auto-updates for these security releases, demonstrates a commitment to rapid remediation. The WordPress security team has also published advisories detailing the vulnerabilities and the patches applied.

The CVE scoring for these vulnerabilities presents an interesting discrepancy. WordPress’s own security advisory rates the chained RCE vulnerability as "Critical." However, the Common Vulnerabilities and Exposures (CVE) record for the RCE chain scores it at 7.5, categorizing it as "High." This score, according to the advisory, focuses primarily on data access and does not fully account for the integrity or availability losses typically associated with code execution. The SQL injection vulnerability, on its own, receives a higher score, exceeding 9.1 and thus classified as "Critical." This highlights the importance of tracking both CVEs individually rather than solely relying on the "Critical RCE" label, as the SQL injection itself represents a severe threat.

Security firms are also actively responding. Rapid7 has indicated that authenticated checks for their InsightVM and Nexpose vulnerability management platforms will include wp2shell starting July 20. While the vulnerability is not yet listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog, which requires confirmed exploitation in the wild, the rapid public disclosure of a working proof-of-concept means that exploitation is likely imminent, if not already occurring.

Broader Implications and Future Concerns

The wp2shell vulnerability serves as a stark reminder of the ongoing security challenges faced by the vast WordPress ecosystem. With over 500 million websites relying on WordPress, any core vulnerability can have a cascading effect, impacting businesses, individuals, and organizations of all sizes.

The speed at which the exploit mechanism and a working proof-of-concept became publicly available after the patch release is a double-edged sword. While it allows security professionals and site owners to understand the threat, it also provides attackers with the tools to exploit unpatched systems. This underscores the critical importance of timely updates. WordPress’s decision to enable forced updates for these critical patches is a pragmatic approach to mitigate widespread exploitation, but it also raises questions about the autonomy of site owners who may have intentionally disabled auto-updates. The company has not yet clarified whether these forced updates will reach sites that have explicitly opted out of automatic updates.

The history of WordPress security incidents is replete with examples of mass exploitation. A recent incident involving a caching plugin vulnerability, which was public and patched but only worked on a non-default setting, still managed to compromise over 17,000 sites. The wp2shell vulnerability, being present in the core and exploitable on default installations, presents an even more significant threat.

Mitigation Strategies for Site Owners

For WordPress site owners who cannot immediately update to the patched versions, Searchlight Cyber has outlined several mitigation strategies. These are considered stopgap measures and should not replace the immediate application of updates:

• Restrict Access to the Batch Endpoint: The primary mitigation involves preventing anonymous access to the /wp-json/batch/v1 endpoint. This can be achieved through various methods, including:
  • Web Server Configuration: Modifying web server configurations (e.g., Apache or Nginx) to block requests to this specific endpoint for unauthenticated users.
  • Web Application Firewall (WAF) Rules: Implementing WAF rules that specifically detect and block the known malicious patterns associated with the wp2shell exploit.
  • Plugin-Based Restrictions: Utilizing security plugins that offer granular control over API endpoint access.

It is crucial to note that implementing these restrictions can potentially disrupt legitimate integrations or plugins that rely on the batch endpoint for their functionality. Therefore, thorough testing is essential after applying any such measures.

The open-source nature of WordPress means that once a patch is released, the underlying code changes are publicly visible. This transparency, while beneficial for collaboration and security auditing, also means that malicious actors can reverse-engineer patches to understand the vulnerabilities. The speed at which the exploit details and proof-of-concept emerged after the WordPress release highlights this dynamic. The race is now on for site owners to apply the patch before attackers can fully leverage the publicly available exploit code.

The ultimate impact of the wp2shell vulnerability will be determined by the adoption rate of the patched WordPress versions versus the rate of exploitation by attackers. As WordPress’s version statistics track patch adoption and network traffic analysis can monitor attempts to exploit the batch endpoint, the relative steepness of these curves will define how this critical security incident is remembered in the annals of web security.