Full research report
CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core
Executive assessment
The wp2shell vulnerability is a two-CVE RCE chain in WordPress core, not a single bug. CVE-2026-63030 (REST API batch-route confusion, introduced in WordPress 6.9 released December 2025) acts as an authentication bypass, exposing CVE-2026-60137 (SQL injection in WP_Query's author__not_in parameter) to unauthenticated callers. Together they allow full server compromise on default WordPress installations without a persistent object cache. Disclosure on 17 July 2026 was accompanied by patches (6.9.5, 7.0.2) and WordPress-forced auto-updates, but public PoCs emerged within hours and three independent security firms — Patchstack, Hexastrike, and WatchTowr — confirmed active in-the-wild exploitation by 20–21 July. No specific threat actor has been attributed, and the attack window between disclosure and exploitation has narrowed significantly, reflecting an industry-wide trend towards AI-accelerated weaponisation.
What happened
On 17 July 2026 WordPress disclosed and patched a two-CVE RCE chain dubbed wp2shell. CVE-2026-63030 is a route-confusion weakness in the REST API batch endpoint introduced in WordPress 6.9 (released December 2025); CVE-2026-60137 is a SQL injection in WP_Query's author__not_in parameter present from 6.8. Chained, they allow a completely unauthenticated attacker to achieve remote code execution on any default WordPress installation lacking a persistent object cache. Public PoCs emerged within hours of disclosure, and multiple independent security firms confirmed active in-the-wild exploitation by 20–21 July 2026.
Affected scope
Full RCE chain: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 (default installations without Redis/Memcached). SQL injection only: WordPress 6.8.0–6.8.5 (requires authentication on its own). Fixed in 6.8.6, 6.9.5, and 7.0.2. WordPress 7.1 beta2 also contains both fixes. The WordPress.org team enabled forced automatic updates for all affected hosted installations.
Technical assessment
CVE-2026-63030 exploits a request-array misalignment in the /wp-json/batch/v1 endpoint, causing subsequent sub-requests to execute under different route handlers and bypass endpoint authentication allowlists. This grants anonymous access to authenticated REST routes. CVE-2026-60137 is a SQL injection in WP_Query triggered via the author__not_in parameter when authentication gating is removed by the first flaw. In combination and on installations without persistent object caching, the chain enables unauthenticated creation of administrative users and arbitrary server-side code execution. No plugins or configuration changes are required on affected versions.
Recommended defensive actions
- Update all WordPress installations to 6.9.5, 7.0.2, or 7.1 beta2 immediately; verify automatic updates have applied on all internet-facing sites.
- Block unauthenticated requests to /wp-json/batch/v1 at the WAF or reverse-proxy layer as a temporary mitigation where immediate patching is not possible (Cloudflare deployed managed rules across all plan tiers).
- Audit WordPress admin user lists for unexpected accounts created since 17 July 2026 as an indicator of potential compromise.
- Deploy a persistent object cache (Redis or Memcached) as a defence-in-depth measure; this breaks the SQL injection path in the RCE chain on unpatched installations.
Uncertainties and evidence gaps
- No specific threat actor or campaign has been attributed to the observed in-the-wild exploitation; the scale and precise victim count are not publicly disclosed.
- The stated CVSS score of 7.5 conflicts with the Critical severity classification in the GitHub advisory; scoring rationale has not been formally explained by the assigning authority.
- The exact conditions under which persistent object caching fully mitigates the SQL injection step are not independently verified; it should not be treated as a substitute for patching.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Public PoCs appeared within hours of the 17 July 2026 disclosure; in-the-wild exploitation confirmed by multiple security firms by 20–21 July 2026.
Investigation began with the two supplied source URLs (Rapid7 ETR and the GitHub security advisory), which established the technical scope and confirmed a two-CVE chain. Broader search confirmed multiple independent corroborating sources and revealed that exploitation progressed from PoC-only on 17 July to confirmed in-the-wild by 20–21 July, a gap of approximately three days. Fetching VulnCheck, The Hacker News, SecurityWeek, BleepingComputer, and the related SQL injection advisory (GHSA-fpp7-x2x2-2mjf) resolved the exploitation timeline, researcher credits, and affected version matrix with high confidence.
- What does the Rapid7 ETR say about the vulnerability, affected versions, and exploitation status?Fetched Rapid7 blog postrapid7.com ↗
Confirmed CVE-2026-63030 as REST API batch-route confusion; CVSS 7.5; affected versions 6.9.0–7.0.1; fixed in 6.9.5/7.0.2; no PoC or exploitation as of 17 July but Rapid7 expected PoC imminent.
why Rapid7 is a primary vendor source with a track record of accurate ETRs; this established the baseline technical facts and initial exploitation assessment.
- What does the official GitHub security advisory say, and are there related advisories?Fetched GHSA-ff9f-jf42-662qgithub.com ↗
Confirmed Critical severity; chained with GHSA-fpp7-x2x2-2mjf (SQL injection); discovered by Adam Kues at Assetnote/Searchlight Cyber; immediate update recommended.
why Official vendor advisory is the authoritative record; the reference to a related advisory indicated a two-CVE chain requiring further investigation.
- What broader coverage and corroboration exists for the exploitation chain and CVE-2026-60137?Searched for CVE-2026-63030 wp2shell and CVE-2026-60137 SQL injection coverage
Multiple independent outlets confirmed the two-CVE chain; VulnCheck and SecurityWeek reported exploitation confirmed by 20–21 July; BleepingComputer confirmed public PoCs.
why Search results spanning vulncheck.com, securityweek.com, bleepingcomputer.com, and thehackernews.com provided independent corroboration from distinct organisations.
- Has exploitation been confirmed in the wild, and by whom?Fetched VulnCheck analysisvulncheck.com ↗
VulnCheck Canary Intelligence observed confirmed exploitation by 20 July; over two dozen PoCs verified by 19 July; detailed version matrix for both CVEs confirmed.
why VulnCheck is an independent exploitation-tracking authority; their canary intelligence constitutes primary evidence for exploitation confirmation.
- What was the exploitation status at the time of initial disclosure, and what technical mechanism was described?Fetched The Hacker News articlethehackernews.com ↗
No exploitation confirmed as of 18 July; detailed batch-endpoint misalignment and author__not_in SQL injection mechanism described; batch endpoint only introduced in WordPress 6.9 (December 2025).
why Established the exploitation timeline baseline (no wild exploitation on day one) and provided the clearest non-weaponisable technical mechanism description.
- When was exploitation first observed in the wild and by which firms?Fetched SecurityWeek exploitation-in-the-wild articlesecurityweek.com ↗
Exploitation confirmed over the weekend following the Friday 17 July patch, with Patchstack, Hexastrike, and WatchTowr all independently reporting attacks by ~21 July.
why Three independent security firms citing exploitation from different vantage points (honeypots, incident response, WAF telemetry) constitutes strong corroboration.
- Are public PoC repositories confirmed and what temporary mitigations are available?Fetched BleepingComputer article on public exploitsbleepingcomputer.com ↗
PoCs published on GitHub post-disclosure; watchTowr CEO confirmed first exploitation signs; Cloudflare deployed WAF rules; WAF block of /wp-json/batch/v1 recommended as temporary mitigation.
why Confirmed PoC availability and identified concrete temporary mitigations, closing the gap between 17 July disclosure and full patching by organisations.
- What are the precise details of the SQL injection component CVE-2026-60137?Fetched GHSA-fpp7-x2x2-2mjfgithub.com ↗
CVE-2026-60137 is Moderate severity; affects 6.8.0–7.0.1; SQL injection in author__not_in parameter of WP_Query; discovered by TF1T, dtro, and haongo; fixed in 6.8.6, 6.9.5, 7.0.2.
why Confirmed the second CVE's scope, severity, researcher credits, and the broader version matrix including 6.8.x which is not exposed to full RCE but is still vulnerable to the SQL injection alone.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 1 PoC/exploit references). 59 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| Rapid7news | ok1 records | Primary evidence2 matched items | Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research. |
| BleepingComputernews | ok11 records | PoC reference1 matched items | Supplied a PoC or technical exploit reference opened and verified during focused research. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1647 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5307 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok260 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok661 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1005 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| FIRST EPSSepss | ok6925 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok14 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok14 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1583 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 5 opened outside the registered collection
PoC & exploit code1
Confirms public PoCs released on GitHub post-disclosure; cites watchTowr observing first exploitation signs
Vendor & gov advisories2
Official WordPress GitHub security advisory; lists affected versions and patched releases
Related advisory for the SQL injection component of the RCE chain; moderate severity on its own
Analysis & research4
First detailed technical breakdown; documents exploitation preconditions including absence of persistent object caching
Corroborates confirmed in-the-wild exploitation by 20 July; documents over two dozen verified PoCs
Detailed chain description; confirms no exploitation as of 18 July, pre-dating later confirmation
Corroborates exploitation timeline; cites Patchstack, Hexastrike and WatchTowr as independent confirmation sources