wp2shell WordPress Core Remote Code Execution Chain (CVE-2026-63030 & CVE-2026-60137)

The "wp2shell" exploit chain represents a critical security event targeting the fundamental architecture of the WordPress ecosystem. This is a pre-authentication Remote Code Execution (RCE) vulnerability residing entirely within WordPress Core. It requires no third-party plugins, themes, or authenticated access to execute. A single crafted HTTP request against a default, "stock" installation can result in unauthenticated attacker gaining full system control.

The severity of this threat is reflected in its CVSS score of 9.8. CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog after exploitation activity was observed shortly following disclosure. Data indicates that approximately 60% of organizations using WordPress were initially vulnerable at the time of disclosure, with a significant portion exposing these servers directly to the internet.

Successful exploitation can allow complete database compromise, persistent web server access via obfuscated webshells, and unauthorized administrative account creation.

Vulnerability Overview

The wp2shell exploit chain combines multiple WordPress Core vulnerabilities to achieve unauthenticated privilege escalation. The attack first abuses a flaw in REST API batch request processing to bypass request validation and authorization checks. This access is then used to exploit a SQL injection vulnerability in the WP_Query handling of the author_exclude parameter.

Using the SQL injection primitive, an attacker can manipulate cached WordPress objects and abuse the oEmbed caching mechanism to write malicious data back to the database. The exploit then leverages Customizer changeset functionality to temporarily inherit the permissions of an administrator account, ultimately creating a persistent administrative user.

In summary, the attack progresses through four stages:

1. REST API validation bypass via batch request desynchronization.
2. SQL injection through improper parameter sanitization.
3. Object cache poisoning and database manipulation using oEmbed write-back behavior.
4. Privilege escalation and persistence via administrator account creation.

When chained together, these vulnerabilities can allow an unauthenticated attacker to obtain full administrative control of a vulnerable WordPress installation.

The following WordPress core vulnerabilities are used in this exploit:

• CVE-2026-63030 (REST API Batch Route Confusion): A logic error in WP_REST_Server::serve_batch_request_v1() where a failure to handle WP_Error objects causes a desynchronization between internal request-handling arrays, allowing unvalidated requests to inherit the permissions of benign handlers.
• CVE-2026-60137 (WP_Query SQL Injection): A type-juggling flaw in the WP_Query engine. When specific parameters receive a raw string instead of an expected array, integer sanitization is bypassed, leading to raw string interpolation in SQL WHERE clauses.

Affected vs Fixed Versions

Strategic Assessment: WordPress Risk

Historically, WordPress security focused on the "plugin perimeter." This exploitation demonstrates that significant security risks can originate within WordPress Core and not solely through third-party extensions. Organizations should ensure WordPress instances are incorporated into formal vulnerability and patch management programs.

WordPress should be considered a high-value target from a defensive perspective. Its widespread deployment across internet-facing environments makes it an attractive platform for threat actors, increasing the likelihood of vulnerability research, automated scanning, and exploitation attempts.

Strategic Governance Pillars

• Attack Surface Mapping: Continuously inventory all WordPress assets. The majority of compromises occur on forgotten, unpatched staging instances.
• Continuous Validation: Do not rely on "auto-update" status. Implement automated version checking to ensure patches are actually active.
• Trust but Verify: While WordPress.org enables forced updates, administrators must verify completion on every host configuration.
• Credential and Salt Rotation: In the event of a suspected Core vulnerability, rotating database salts in wp-config.php is a mandatory strategic defense to invalidate existing sessions.

Threat Hunting & Indicators of Compromise (IoCs)

Network Signals

• HTTP 207 Multi-Status: This is a high-fidelity signal for successful exploitation attempts via the batch API.
• WAF Bypass Awareness: Attackers may use %2F escapes in the ?rest_route= parameter to bypass simple string matching. WAFs must be configured to perform URL decoding before matching.
• User-Agents: Monitor for wp2shell, rezwp2shell, or cve-2026-63030/1.0.

Host-Based Artifacts

• File Markers: Search for temp-write-test- in the wp-content/ directory, used by exploit kits to verify write permissions.
• Malicious Plugins: Look for directories using a hex suffix, such as wp-content/plugins/wp2shell_/.
• CMSmap Distinction: Forensic teams must distinguish between the legitimate 11KB CMSmap tool and the 150KB obfuscated platform observed in current campaigns.

Known IOCs

Mitigations and Remediations

Organizations must immediately update WordPress Core to versions 7.0.2, 6.9.5, or 6.8.6. While WordPress.org has pushed forced updates, administrators must "trust but verify" these installations, as auto-update completion is not guaranteed on all host configurations. Priority must be given to instances on the 6.9.x and 7.0.x branches, which are susceptible to the full RCE chain.

Temporary Mitigations

Where immediate patching is not possible, administrators should implement WAF rules to block unauthenticated access to the affected REST API batch endpoints. URL decoding should be performed prior to rule matching to detect encoded requests.

Blocked endpoints:

• /wp-json/batch/v1
• ?rest_route=/batch/v1 (including URL-encoded variants such as %2Fbatch%2Fv1)

Post-Compromise Actions

If there is reason to believe exploitation has occurred, the following actions are recommended:

• Verify Core File Integrity: Run wp core verify-checksums to identify modified or unauthorized WordPress core files.
• Rotate Credentials: Reset database credentials and regenerate the authentication salts and security keys within wp-config.php.
• Review User Accounts: Audit the wp_users table for unauthorized accounts, particularly any accounts using the w2s_ naming convention.
• Hunt for IOCs: Search web server logs, file systems, and security monitoring tools for the indicators of compromise listed in this advisory.

If you are worried about any of the threats outlined in this bulletin or need help in determining what steps you should take to protect yourself from the most material threats facing your organisation, please contact your account manager, or alternatively get in touch to find out how you can protect your organisation.