Full research report

WordPress Core "wp2shell" RCE flaws get public exploits, patch now

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

The wp2shell chain is architecturally notable for making a conditionally exploitable SQL injection (CVE-2026-60137, affecting 6.8 and later, ordinarily requiring a plugin to relay untrusted input) fully unauthenticated by pairing it with a route-confusion flaw (CVE-2026-63030) introduced in the same 6.9 development cycle. This means 6.8.x installations face a high-severity database exposure but not the full pre-authentication RCE, while 6.9.x and 7.0.x sites are exposed to the complete chain — a distinction that matters for patching prioritisation. The CVSS score divergence between WPScan's CNA assignments and CISA-ADP's supplementary scores reflects genuine disagreement about standalone versus chained impact rather than error; defenders should use CVSS 9.8 as the operational risk baseline. The exploitation timeline is the most operationally significant open question: Rapid7 recorded no exploitation at 17:45 ET on 17 July, PatchStack reported activity within approximately two hours, and watchTowr's 18 July statement of 'first signs of exploitation' suggests scanning or early opportunistic activity rather than targeted campaigns — but this trajectory is consistent with rapid escalation and organisations should treat the patching urgency as immediate regardless of exploitation confirmation status.

What happened

On 17 July 2026 the WordPress security team issued emergency releases — versions 6.8.6, 6.9.5, and 7.0.2 — to address two chained vulnerabilities collectively branded 'wp2shell', discovered by Adam Kues of Searchlight Cyber. The chain allows an unauthenticated attacker to achieve remote code execution on a default WordPress installation with no plugins or special configuration required. WordPress.org enabled forced automatic updates for affected installs on the same day, and Cloudflare deployed WAF blocking rules at 17:03 UTC. By 18 July 2026 multiple proof-of-concept exploits had appeared publicly on GitHub, and security firms watchTowr and PatchStack reported early signs of active exploitation.

Affected scope

The full unauthenticated RCE chain affects WordPress Core versions 6.9.0–6.9.4 and 7.0.0–7.0.1, patched in 6.9.5 and 7.0.2 respectively. CVE-2026-60137 (SQL injection) additionally affects versions 6.8.0–6.8.5, patched in 6.8.6, but cannot be chained to remote code execution on 6.8.x because the batch-route confusion flaw was introduced in version 6.9. Versions prior to 6.8 are unaffected. WordPress estimates more than 500 million public websites run on the platform.

Technical assessment

The attack chains two independent weaknesses. CVE-2026-60137 is an SQL injection in the author__not_in parameter of the WP_Query class; in isolation it requires a plugin or theme to relay untrusted input. CVE-2026-63030 is a route-interpretation conflict in the REST API's /wp-json/batch/v1 endpoint introduced in WordPress 6.9, which provides an unauthenticated pathway to trigger the internal query without any plugin intermediary. Together, the chain allows database contents including credential hashes to be extracted and — via subsequent steps documented in public PoCs — full remote code execution. The severity of each flaw in isolation is lower than the combined chain, which explains the CVSS divergence between the WPScan CNA and CISA-ADP assignments.

Recommended defensive actions

  1. Update immediately to WordPress 7.0.2 (7.0.x), 6.9.5 (6.9.x), or 6.8.6 (6.8.x); verify via Settings > Updates in the WordPress dashboard that forced auto-updates have applied
  2. If immediate patching is not possible, block /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF or web server level, or install a plugin that restricts anonymous REST API access — treat this as a temporary measure only
  3. Route site traffic through Cloudflare (any plan tier) to benefit from the WAF Block rules for both CVEs deployed on 17 July 2026
  4. Audit web server and database logs for anomalous unauthenticated POST requests to /wp-json/batch/v1 and for SQL error patterns or unexpected administrative account creations

Uncertainties and evidence gaps

  • In-the-wild exploitation has been reported by watchTowr and PatchStack but has not been confirmed by CISA KEV or an independently verified forensic incident report as of 18 July 2026
  • The timeline of PoC publication versus first exploitation is not precisely established; Rapid7 recorded no exploitation at 17:45 ET on 17 July while PatchStack reportedly flagged activity shortly before 19:00 ET the same day
  • CVSS scores differ substantially between the WPScan CNA and CISA-ADP for both CVEs, reflecting genuine disagreement about standalone versus chained impact; defenders should treat the combined-chain CVSS 9.8 as the operational baseline
  • Some public PoCs reportedly achieve pre-authentication RCE directly without hash extraction; others require credential cracking — the reliability and exact preconditions of the simpler variant have not been independently verified

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessNetwork-accessible WordPress installation; no authentication, no plugins, and no special configuration required for the full chain on affected 6.9.x and 7.0.x versions
ComponentWordPress REST API batch endpoint (/wp-json/batch/v1) and WP_Query SQL query construction (author__not_in parameter)
MechanismA route-interpretation conflict in the batch endpoint allows an unauthenticated request to invoke an internal WordPress execution path that would normally require authentication; this path incorporates user-supplied input into a SQL query without adequate sanitisation
ImpactDatabase contents including password hashes exposed to an unauthenticated attacker; the full chain enables remote code execution and complete website compromise
DetectionAnomalous unauthenticated HTTP POST requests to /wp-json/batch/v1 or ?rest_route=/batch/v1; SQL errors in database logs involving author__not_in; unexpected administrative account creation or plugin installation events
MitigationApply WordPress 6.8.6, 6.9.5, or 7.0.2; block batch-route endpoints at the WAF or reverse proxy if patching is delayed
Exploitation status

Multiple public proof-of-concept exploits published on GitHub by 18 July 2026; watchTowr and PatchStack reported early signs of in-the-wild exploitation on 17–18 July 2026; neither CVE appears in the CISA Known Exploited Vulnerabilities catalogue as of 18 July 2026

Research process

Investigation began from the BleepingComputer source article (18 July 2026) asserting both PoC publication and in-the-wild exploitation for the wp2shell chain. Initial broad searches established researcher identity, CVE assignments, and version scope. Fetching the Searchlight Cyber disclosure, Cloudflare advisory, Rapid7 ETR, and WordPress release note confirmed the patch timeline, WAF deployment, and the state of exploitation as of 17 July — no confirmed exploitation at that point. The BleepingComputer article and VulnCheck post, both dated 18 July, then established that PoCs had emerged and that watchTowr and PatchStack were reporting early exploitation signals. NVD records were retrieved to anchor CVSS scores and confirmed neither CVE is yet in the CISA Known Exploited Vulnerabilities catalogue, providing a calibration point against the private-firm exploitation reports. GitHub GHSA advisory pages returned 404 and were excluded from citations.

  1. What are CVE-2026-60137 and CVE-2026-63030, and what is the scope of the wp2shell incident?
    Searched for CVE-2026-60137 CVE-2026-63030 WordPress wp2shell RCE 2026

    Both CVEs relate to a chained pre-authentication RCE in WordPress Core; CVE-2026-63030 is the REST API batch-route confusion; CVE-2026-60137 is the SQL injection; affects WordPress 6.9.x and 7.0.x for full RCE; discovered by Adam Kues of Searchlight Cyber

    why Established basic event framing, researcher identity, CVE assignments, and affected version scope before fetching primary sources

  2. What does the original researcher disclose about mechanism, scope, and defensive posture?
    Fetched the Searchlight Cyber research advisory
    slcyber.io ↗

    Adam Kues confirmed pre-authentication RCE via the batch API on default WordPress installs; fixed in 7.0.2 and 6.9.5; full technical details withheld at disclosure time; wp2shell.com vulnerability checker released

    why Primary source for the researcher's own characterisation and responsible-disclosure posture; confirmed intentional technical detail withholding

  3. Did Cloudflare deploy WAF protections, and does the advisory indicate exploitation status at time of publication?
    Fetched the Cloudflare blog advisory
    blog.cloudflare.com ↗

    Cloudflare deployed Block rules for both CVEs on 17 July 2026 at 17:03 UTC across all plan tiers; no in-the-wild exploitation observed at publication time; coordinated with WordPress security team before public disclosure

    why Confirmed WAF mitigation timeline and that coordinated disclosure preceded exploitation at that point

  4. What is Rapid7's exploitation likelihood assessment, and how do CVSS scores vary by authority?
    Fetched the Rapid7 Emergency Threat Response post
    rapid7.com ↗

    No exploitation confirmed as of 17 July 17:45 ET; Rapid7 assessed public PoC emergence as highly likely given AI-assisted code analysis; CVSS 9.8 (WPScan CNA) vs 7.5 (CISA-ADP) for CVE-2026-63030

    why Independent corroboration; Rapid7's PoC-emergence prediction proved accurate within 24 hours; CVSS divergence noted

  5. What does the official WordPress security advisory state about affected branches, patches, and auto-update policy?
    Fetched the WordPress 7.0.2 release announcement
    wordpress.org ↗

    Released 17 July 2026; addresses one critical and one high flaw via GHSA-ff9f-jf42-662q and GHSA-fpp7-x2x2-2mjf; forced auto-updates enabled; backports to 6.9.5 and 6.8.6

    why Vendor primary source; confirmed auto-update mechanism and that 6.8.x receives a SQL-injection-only patch

  6. Are public PoCs confirmed available, and what is the exploitation picture as of 18 July?
    Fetched the BleepingComputer article dated 18 July 2026
    bleepingcomputer.com ↗

    Multiple GitHub PoCs confirmed published; some combine hash extraction, credential cracking, and plugin upload; others claim direct pre-auth RCE; watchTowr reports 'first signs of in-the-wild exploitation'

    why Established that PoC availability is credible and that exploitation signals exist; 'first signs' language indicates it is not yet confirmed mass exploitation

  7. Does VulnCheck corroborate exploitation intelligence from other firms?
    Fetched the VulnCheck blog post on wp2shell
    vulncheck.com ↗

    VulnCheck confirmed the chaining mechanism; cited PatchStack-reported exploitation beginning approximately 19:00 ET on 17 July; characterised CVE-2026-63030 as an authentication bypass enabling the SQL injection

    why Second independent firm corroborating early exploitation activity; adds weight without constituting confirmed mass exploitation

  8. What do NVD records establish for CVSS, CWE, and CISA KEV status?
    Fetched NVD entries for both CVEs
    nvd.nist.gov ↗

    CVE-2026-63030: CVSS 9.8 (WPScan)/7.5 (CISA-ADP), CWE-436, no KEV listing. CVE-2026-60137: CVSS 5.9 (WPScan)/9.1 (CISA-ADP), CWE-89, no KEV listing

    why Government authoritative scoring; absence from CISA KEV as of 18 July calibrates private-firm exploitation reports as early and unconfirmed rather than established

Named in this story
TargetsWordPress Core installations running versions 6.8.0–7.0.1organisations relying on WordPress-hosted websitesweb hosting providers and WordPress managed-hosting platforms
Related CVEs CVE-2026-60137CVE-2026-63030

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 3 registered sources supplied useful evidence (2 primary, 1 corroborating, 0 contextual and 0 PoC/exploit references). 58 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok empty0 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied a PoC or technical exploit reference opened and verified during focused research.
NVDcve ok900 records Primary evidence2 matched items Supplied a vendor or government advisory opened and verified during focused research.
Rapid7news ok empty0 records Corroborating1 matched items Supplied independent analysis opened and verified during focused research.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1647 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5307 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok257 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok661 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok6867 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok6 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok9 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok9 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1583 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 6 opened outside the registered collection
References & evidence
Technical references2
github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q ↗

Repository captured from the source article as technical context; not validated as PoC or exploit code.

github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf ↗

Repository captured from the source article as technical context; not validated as PoC or exploit code.

PoC & exploit code1
WordPress Core 'wp2shell' RCE Flaws Get Public Exploits, Patch Now — BleepingComputer bleepingcomputer.com ↗

Confirms multiple GitHub PoCs published post-disclosure; cites watchTowr's observation of early in-the-wild exploitation

Vendor & gov advisories4
WordPress 7.0.2 Security Release — WordPress.org wordpress.org ↗

Official vendor advisory; confirms both CVEs, affected branches, fixed versions, and forced auto-update deployment

Cloudflare WAF Protects WordPress Applications from Two High-Severity Vulnerabilities — Cloudflare Blog blog.cloudflare.com ↗

Confirms WAF Block rules for both CVEs deployed 17 July 2026 at 17:03 UTC across all Cloudflare plan tiers

NVD — CVE-2026-63030 nvd.nist.gov ↗

CVSS 9.8 Critical (WPScan CNA) / 7.5 High (CISA-ADP); CWE-436 Interpretation Conflict; no KEV listing as of 18 July

NVD — CVE-2026-60137 nvd.nist.gov ↗

CVSS 5.9 Medium (WPScan CNA) / 9.1 Critical (CISA-ADP); CWE-89 SQL Injection; no KEV listing as of 18 July

Analysis & research3
wp2shell: Pre-Authentication RCE in WordPress Core — Searchlight Cyber slcyber.io ↗

Primary researcher disclosure by Adam Kues; withholds full technical details pending wider patching; releases wp2shell.com vulnerability checker

ETR: CVE-2026-63030 wp2shell — Rapid7 rapid7.com ↗

Rapid7 emergency threat response; no exploitation confirmed as of 17 July; assesses public PoC emergence as highly likely given AI-assisted code analysis

WP2Shell Vulnerabilities: CVE-2026-60137 and CVE-2026-63030 — VulnCheck vulncheck.com ↗

Independent technical decomposition; cites PatchStack report of exploitation beginning approximately 19:00 ET on 17 July 2026