Researchers Detail Unauthenticated WordPress RCE Chain in WP2Shell Attack
Analysis reveals how attackers chain REST API and SQL injection flaws to seize full control of WordPress sites without valid credentials.
Key points
- The WP2Shell exploit chain affects WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1.
- It combines CVE-2026-63030, a REST API route confusion flaw, with CVE-2026-60137, an SQL injection vulnerability.
- Attackers can create administrator accounts and deploy web shells without needing initial login credentials.
Security researcher Amruta Wagh from Seqrite has documented a critical exploit chain dubbed WP2Shell that allows unauthenticated remote code execution in WordPress Core. According to analysis published by GBHackers, this technique emerged in July 2026 and enables attackers to compromise servers directly from public endpoints without possessing valid user credentials.
The attack vector chains two specific vulnerabilities to bypass standard authentication requirements. The first flaw, identified as CVE-2026-63030, resides in the REST API batch controller at the /wp-json/batch/v1 endpoint. This component processes multiple API requests within a single JSON payload, but nested batch structures can confuse route resolution and dispatch requests to unintended handlers, granting access to protected functionality.
Technical Mechanics of the Exploit Chain
This route confusion serves as the entry point for the second stage, which exploits CVE-2026-60137, an SQL injection vulnerability in the posts endpoint. The public author_exclude parameter maps internally to the author__not_in argument in WP_Query, and insufficient input handling allows crafted values to manipulate database queries. By combining these weaknesses, attackers can manipulate the database through the exposed batch interface.
The exploitation sequence demonstrates a multistage compromise rather than immediate code execution. Attackers first establish an administrator account using the SQL injection vector. They then deploy a malicious plugin containing a web shell to achieve full server control. This method bypasses the initial account compromise normally required for administrative actions, creating a direct path from an exposed website to server takeover.
Affected Versions and Indicators
The reported chain affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. In observed environments, the web server process httpd.exe performed the file writes associated with the attack. Initial staging activity involves creating temporary files matching temp-write-test-* beneath the wp-content/ directory to check writability, which are subsequently removed. Attackers then stage a ZIP archive, such as wp2shell_4e9b3641.zip, under wp-content/uploads/2026/10/, extracting PHP payloads into temporary upgrade directories before moving them to the active plugins folder.
What should you do?
As Threat Times reported on 2026-10-16 regarding similar critical flaws in ZoneMinder and MariaDB, unauthenticated remote code execution poses severe risks. Administrators running affected WordPress versions should verify their current build immediately. Since no patch has been confirmed for these specific CVEs in the source material, reducing exposure through strict access controls is essential. Monitor server logs for unusual batch API requests and unexpected file creation in the wp-content directory.
What to do and how to stay safe: WordPress
- Verify your WordPress Core version against the affected range (6.9.0-6.9.4 and 7.0.0-7.0.1) and prepare to apply updates once vendors release them.
- Restrict access to the /wp-json/batch/v1 endpoint using web application firewalls or server-level rules to limit exposure to unauthenticated API abuse.
- Monitor file system activity for temporary files matching temp-write-test-* or unusual ZIP archives in upload directories, which may indicate staging for web shell deployment.
- Review server logs for anomalies in the httpd.exe process or unexpected database queries originating from public endpoints to detect early signs of compromise.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which WordPress versions are vulnerable to the WP2Shell exploit chain?
WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected by the combination of CVE-2026-63030 and CVE-2026-60137.
Does the WP2Shell attack require valid user credentials?
No, the exploit chain allows attackers to execute remote code and create administrator accounts without possessing valid WordPress credentials.
What are the two CVE IDs associated with this vulnerability chain?
The chain involves CVE-2026-63030, a REST API route confusion flaw, and CVE-2026-60137, an SQL injection vulnerability in the posts endpoint.
