WP2Shell Chain Allows Unauthenticated WordPress Admin Account Creation
Researchers detail how chaining two core WordPress flaws enables attackers to install web shells and create admin accounts without valid login credentials.
Key points
- WP2Shell combines CVE-2026-63030 and CVE-2026-60137 to bypass authentication.
- The chain allows unauthenticated attackers to execute code on the server.
- Seqrite disclosed the technique in an analysis published on October 16.
Analysts at Seqrite identified a vulnerability chain named WP2Shell that allows attackers to seize control of WordPress sites without logging in, according to a report published on October 16. The technique combines two core flaws to create administrator accounts and install plugin-based web shells on affected installations.
The WP2Shell method links CVE-2026-63030 and CVE-2026-60137 to move from a public request to server-side code execution. This sequence removes the need for valid credentials, enabling attackers to establish a foothold on sites running vulnerable versions of the software.
Technical Details of the Exploit Chain
The first vulnerability, CVE-2026-63030, affects the REST API batch controller located at the /wp-json/batch/v1 endpoint. According to Seqrite, this flaw allows nested requests to confuse route handling and reach functionality that should require authentication. This issue alone does not execute code but provides the necessary path to the second weakness.
The second flaw, CVE-2026-60137, is an SQL injection vulnerability in the posts endpoint. The public author_exclude parameter maps to author__not_in in WP_Query, and poorly handled input can affect the database query. When chained with the route flaw, an unauthenticated request can reach this vulnerable query, leading to remote code execution.
Impact and Affected Systems
The chain’s impact stems from how the two issues work together rather than either flaw being a direct web shell by itself. Once code runs on the server, an attacker may make further changes beyond the WordPress dashboard, according to the analysis.
The demonstrated steps include creating an unexpected administrator account, staging a ZIP archive in uploads, unpacking PHP files, and moving a plugin directory into wp-content/plugins. This plugin acts as a web shell, providing an interface for running server commands. Cyber Security News has covered separate WordPress account creation vulnerabilities and recent Comment2Shell vulnerability coverage.
What should you do?
Seqrite’s October 16 analysis lists affected releases but does not establish widespread live exploitation. The report states that the flaws were disclosed in July 2026. Defenders should monitor for suspicious administrator accounts or unexpected plugins on their sites.
What to do and how to stay safe: WordPress
- Check WordPress installations for unexpected administrator accounts that were not created by site owners.
- Review the wp-content/plugins directory for new or modified plugin directories that could act as web shells.
- Monitor server logs for unusual activity related to the /wp-json/batch/v1 endpoint and the posts endpoint.
- Ensure WordPress core is updated to the latest version once the vendor provides a fix for these vulnerabilities.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is WP2Shell?
WP2Shell is a vulnerability chain that combines CVE-2026-63030 and CVE-2026-60137 to allow unauthenticated attackers to execute code on WordPress sites.
Are there signs of widespread exploitation?
No, Seqrite’s analysis does not establish widespread live exploitation of the WP2Shell chain as of October 16.
How does the exploit work?
It uses a REST API batch controller flaw to bypass authentication and reach an SQL injection vulnerability in the posts endpoint.
