Researchers Detail WP2Shell Chain Allowing Passwordless WordPress Takeover
Attackers can seize control of default WordPress sites by chaining two core flaws, bypassing authentication without needing third-party plugins.
Key points
- The WP2Shell chain combines CVE-2026-63030 and CVE-2026-60137 in WordPress core.
- Unauthenticated attackers can reach administrative states without stealing passwords.
- Public exploit code is in use, making unpatched installations urgent risks.
Security researchers disclosed details in July 2026 regarding a chained attack vector that allows unauthorized control of WordPress websites. Dubbed WP2Shell, this technique exploits two specific flaws within the platform’s core code. According to GBHackers, the attack enables compromise without requiring the theft of user credentials or the presence of vulnerable third-party extensions.
The vulnerability chain relies on CVE-2026-63030 and CVE-2026-60137 working in sequence. This combination affects default WordPress installations, meaning site owners cannot mitigate the risk by removing plugins. The availability of public exploit code and evidence of active exploitation have elevated the urgency for remediation among administrators running unpatched deployments.
Technical Mechanics of the Attack
The initial entry point is CVE-2026-63030, which targets the REST API batch controller located at /wp-json/batch/v1. This component is designed to process multiple API requests contained within a single JSON payload. Attackers craft nested requests that confuse the route resolution logic. This confusion allows unauthenticated users to access handlers that typically require authentication, providing an initial foothold rather than direct code execution.
The second phase exploits CVE-2026-60137, an SQL injection flaw in the posts endpoint. The public author_exclude parameter maps to the internal author__not_in argument in WP_Query. Insufficient sanitization of this input allows malicious data to alter database queries. This transforms the routing weakness into a functional database attack primitive, bridging the gap between initial access and deeper system compromise.
Observed Exploitation and Impact
Akamai’s analysis indicates that attackers leverage WordPress object caching and post-processing behaviors to manipulate application state. This manipulation allows them to assume an administrative context and create privileged accounts. Crucially, this process bypasses the need to crack password hashes. Seqrite Researchers confirmed that the combination of REST API route confusion and SQL injection enables progress from public endpoints to remote code execution.
F5 Labs captured exploitation attempts against its network sensors, providing concrete evidence of the attack in the wild. The firm noted that while it observed the exploit requests, it did not witness the deployment of a web shell during these specific incidents. This distinction helps investigators separate demonstrated technical capabilities from confirmed post-exploitation outcomes.
F5 Labs identified exploit requests originating from the IP address 185.242.3.238. These requests delivered nested batch payloads and UNION-based SQL injection techniques. The same 735-byte payload targeted at least two US-based sensors, suggesting automated replay rather than manual probing. The source address represents observed infrastructure and does not constitute attribution to a specific threat actor group.
What should you do?
Administrators should verify whether their WordPress installations are running versions that address these specific CVEs. Since the flaws exist in the core, updating the platform itself is the primary mitigation. Monitoring logs for unusual activity at the /wp-json/batch/v1 endpoint can help detect early stages of the attack chain.
What to do and how to stay safe: WordPress
- Check your WordPress version against the vendor's advisory for CVE-2026-63030 and CVE-2026-60137.
- Review access logs for requests targeting the /wp-json/batch/v1 endpoint from unknown sources.
- Monitor for unexpected new administrative accounts or changes to database queries.
- Once the vendor provides an update, apply it immediately to all default installations.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Do I need to remove plugins to be safe from WP2Shell?
No, the attack affects default WordPress installations and does not require third-party plugins.
Is there a specific hacker group behind this attack?
No, F5 Labs stated the observed IP address represents infrastructure, not attribution to a specific actor.
Does this attack steal passwords?
No, the chain allows attackers to assume administrative context without cracking password hashes.
