Listen to this Post
Introduction: A Dangerous Moment for the
WordPress powers a significant portion of the internet, serving everyone from personal bloggers and small businesses to multinational enterprises and government organizations. Its popularity has always made it an attractive target for cybercriminals, but vulnerabilities capable of compromising the WordPress Core itself—without relying on third-party plugins—are exceptionally uncommon. That is precisely why the newly disclosed wp2shell attack chain has triggered alarm throughout the cybersecurity community.
Security researchers have confirmed that two critical vulnerabilities can be chained together to achieve pre-authentication Remote Code Execution (RCE), allowing attackers to potentially take complete control of vulnerable websites before logging in. With public proof-of-concept (PoC) exploits already circulating online and reports of real-world attacks beginning to emerge, administrators have little time to react. Immediate patching is no longer optional—it is essential.
Summary: What Is the wp2shell Attack?
The newly disclosed wp2shell attack combines two independent WordPress Core vulnerabilities:
CVE-2026-63030 – REST API Batch Route Confusion
CVE-2026-60137 – SQL Injection within the author__not_in parameter of WP_Query
When combined, these flaws allow attackers to execute malicious code against vulnerable WordPress installations without authentication.
Affected versions include:
WordPress 6.9.0 – 6.9.4
WordPress 7.0.0 – 7.0.1
Although the SQL Injection vulnerability also affects WordPress 6.8.x, it cannot be chained into Remote Code Execution because the REST API flaw was introduced beginning with version 6.9.
WordPress has already released security updates:
WordPress 6.9.5
WordPress 7.0.2
Automatic forced security updates have also been enabled for supported installations due to the exceptional severity of the vulnerabilities.
The Discovery That Shocked Security Researchers
The vulnerabilities were discovered by Searchlight Cyber, whose researchers demonstrated that an anonymous attacker could exploit a completely default WordPress installation.
Perhaps the most concerning aspect is that no plugins, themes, or additional misconfigurations are required.
The attack works directly against WordPress Core.
Historically, the majority of WordPress compromises originate from outdated plugins or vulnerable third-party themes. Core vulnerabilities capable of unauthenticated Remote Code Execution are extremely rare, making wp2shell one of the most serious WordPress security events in recent years.
Understanding CVE-2026-63030
The first vulnerability resides within
Specifically, attackers abuse a flaw involving Batch Route Confusion, introduced during the WordPress 6.9 development cycle.
On its own, this bug does not immediately provide full server compromise.
However, it acts as the first stage of a larger exploit chain.
It allows attackers to manipulate REST API requests in unexpected ways, bypassing assumptions made by internal security checks.
When paired with another vulnerability, the results become devastating.
Understanding CVE-2026-60137
The second vulnerability is a classic but highly dangerous SQL Injection issue.
The vulnerable parameter:
author__not_in
inside:
WP_Query
allows malicious SQL statements to be injected into backend database queries.
SQL Injection remains one of the most dangerous classes of vulnerabilities because it can expose:
Usernames
Email addresses
Password hashes
Authentication tokens
Sensitive site configuration
Database contents
Individually this flaw is already considered High Severity.
Combined with the REST API vulnerability, it becomes much worse.
How Attackers Chain the Vulnerabilities
The wp2shell attack is not based on a single weakness.
Instead, attackers chain multiple weaknesses together.
The attack sequence generally follows this pattern:
Exploit REST API confusion.
Trigger SQL Injection.
Extract administrator credentials or sensitive data.
Execute arbitrary commands.
Upload malicious plugins or web shells.
Gain persistent access.
Maintain full control over the compromised server.
Even more concerning, several public exploit developers claim they can skip the administrator credential phase entirely and directly achieve Remote Code Execution.
If verified, this significantly raises the severity of the attack.
Public Exploits Have Already Been Released
Searchlight Cyber initially delayed publishing technical details to allow organizations time to install patches.
Unfortunately, that window has effectively closed.
Multiple GitHub repositories now contain publicly available PoC exploits.
Some demonstrations perform:
Password hash extraction
SQL Injection
Administrator credential recovery
Malicious plugin upload
Remote command execution
Other PoCs reportedly execute code without requiring administrator credentials at all.
This greatly lowers the technical barrier for attackers.
Real-World Attacks Have Already Begun
Security company watchTowr has confirmed early signs of active exploitation.
This is a familiar pattern in cybersecurity.
Timeline:
Vulnerability announced
PoC released
Mass scanning begins
Automated exploitation follows
Once exploit code becomes public, cybercriminals often automate attacks within hours.
Millions of WordPress websites become targets simultaneously.
Cloudflare Responds Quickly
Cloudflare rapidly deployed Web Application Firewall protections across all service plans.
These WAF rules detect attempts to exploit:
CVE-2026-60137
CVE-2026-63030
Remarkably, protection also extends to Free Plan users.
However, Cloudflare clearly emphasizes an important point:
A WAF is not a replacement for installing security updates.
It simply reduces exposure while administrators complete the patching process.
Temporary Mitigation Options
Organizations unable to update immediately should implement temporary defensive measures.
Searchlight Cyber recommends:
Disable anonymous REST API access where possible.
Block the following endpoints:
/wp-json/batch/v1
and
?rest_route=/batch/v1
at the Web Application Firewall.
These mitigations should only remain in place until permanent patches are installed.
Deep Analysis
The wp2shell disclosure illustrates why layered security remains essential even for platforms with mature security programs. A Core vulnerability bypasses the common assumption that simply avoiding vulnerable plugins is enough. Organizations should treat WordPress like any other critical application and continuously validate its security posture.
Security teams should immediately identify exposed WordPress assets and verify their versions.
Useful commands for Linux administrators include:
wp core version
wp core update
wp plugin list
curl https://example.com/wp-json/
curl https://example.com/wp-json/batch/v1
grep "WordPress" /var/www/html/wp-includes/version.php
find /var/www/html -name ".php" -mtime -7
tail -f /var/log/nginx/access.log
tail -f /var/log/apache2/access.log
grep "wp-json" access.log
Administrators should also review recently installed plugins, unexpected administrator accounts, scheduled tasks, and modified PHP files. If compromise is suspected, assume credential theft has occurred, rotate passwords, invalidate sessions, regenerate API keys, and conduct a full forensic review before restoring normal operations. Security monitoring should be expanded to detect unusual REST API activity, SQL injection attempts, and unauthorized file uploads.
What Undercode Say:
The wp2shell incident is one of the most significant WordPress Core security disclosures in years because it targets the platform itself rather than the plugin ecosystem. That distinction changes how defenders should evaluate risk.
Organizations often focus patch management on plugins while assuming the Core platform is inherently stable. This event demonstrates that Core software also requires rapid security maintenance.
The availability of public PoCs dramatically changes the threat landscape. Once exploit code reaches GitHub, attackers no longer need to discover the vulnerability independently—they simply automate what others have already published.
Another critical lesson is that forced automatic security updates, while sometimes controversial, proved valuable in this case. Websites with auto-updates enabled gained protection far sooner than manually managed systems.
The attack chain also highlights how two individually serious vulnerabilities can become catastrophic when combined. Security teams should evaluate vulnerabilities based not only on their standalone CVSS scores but also on their exploitability in chained attacks.
Cloudflare’s rapid deployment of WAF rules demonstrates the growing importance of managed edge security. However, organizations should never rely solely on perimeter defenses. Attackers frequently discover bypass techniques, and WAF signatures may not stop every variation.
Administrators should inventory every WordPress deployment, including forgotten development environments, staging servers, and internal portals. These systems often remain unpatched and provide attackers with an easier entry point than production websites.
Continuous vulnerability scanning should become routine rather than reactive. Waiting for public exploit releases before patching significantly increases exposure.
The incident also reinforces the importance of maintaining reliable offline backups. If attackers achieve Remote Code Execution, recovery may require restoring clean systems rather than simply removing malicious files.
For hosting providers, this event serves as a reminder to strengthen default security configurations, monitor customer environments for exploitation attempts, and provide rapid notification channels when critical vulnerabilities emerge.
From a broader cybersecurity perspective, wp2shell demonstrates that even mature open-source projects with extensive community review can still contain severe flaws. Security is a continuous process of discovery, remediation, and improvement—not a permanent state.
Organizations that combine timely patching, layered defenses, endpoint monitoring, web application firewalls, log analysis, and incident response planning will be significantly more resilient against threats like wp2shell than those relying on a single security control.
✅ Confirmed: WordPress released security updates 6.9.5 and 7.0.2 to address the wp2shell attack chain, and automatic security updates were enabled for supported affected installations due to the critical severity.
✅ Confirmed: The attack chain combines CVE-2026-63030 (REST API Batch Route Confusion) and CVE-2026-60137 (SQL Injection), allowing pre-authentication Remote Code Execution against affected WordPress Core versions. Public proof-of-concept exploits have also been published.
✅ Confirmed: Cloudflare deployed WAF protections for both vulnerabilities across all plans, including free accounts. However, both Cloudflare and security researchers emphasize that WAF protection is only a temporary mitigation and cannot replace installing the official security patches.
Prediction
(+1) Organizations that adopt automatic security updates, continuous vulnerability scanning, and layered web security will significantly reduce their exposure to future WordPress Core vulnerabilities and shorten their response time to critical threats.
(-1) As public exploit code continues to spread across security forums and GitHub repositories, automated botnets are likely to launch widespread internet-wide scanning campaigns targeting unpatched WordPress 6.9.x and 7.0.x installations, leading to mass website compromises, ransomware deployment, SEO spam infections, and long-term persistence on vulnerable servers.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub (Possible Sources for article):
https://www.reddit.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
