{"id":63885,"date":"2026-07-18T16:30:46","date_gmt":"2026-07-18T20:30:46","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=63885"},"modified":"2026-07-18T16:30:46","modified_gmt":"2026-07-18T20:30:46","slug":"wp2shell-wordpress-vulnerability","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/wp2shell-wordpress-vulnerability\/","title":{"rendered":"wp2shell WordPress Flaw Unlocks Unauthenticated Code Execution"},"content":{"rendered":"<p>A <a href=\"https:\/\/overcentral.com\/en\/wordpress-wp2shell-emergency-patch\/\" title=\"WordPress Releases Emergency Patch for Critical wp2shell RCE Flaw\" data-iacss-internal=\"1\">critical<\/a> unauthenticated <a href=\"https:\/\/overcentral.com\/en\/airdrop-quick-share-flaws\/\" title=\"Six AirDrop and Quick Share flaws expose 5 billion devices\" data-iacss-internal=\"1\">remote code execution<\/a> vulnerability chain in WordPress core, tracked as wp2shell, now has CVE identifiers, a published proof-of-concept, and a patch that went out Friday with WordPress versions 6.9.5 and 7.0.2. Two separate flaws \u2014 CVE-2026-63030, a REST API batch-route confusion, and CVE-2026-60137, a SQL injection \u2014 combine to let an anonymous HTTP request execute arbitrary code on a default WordPress installation with no plugins required. Every site running WordPress 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1 was exposed until the forced auto-update began rolling out.<\/p>\n<h2>The Two Flaws Behind wp2shell<\/h2>\n<p>CVE-2026-63030 is the batch-route confusion found by Adam Kues at Assetnote, Searchlight Cyber&#8217;s attack surface management arm. It abuses WordPress&#8217;s <code>\/wp-json\/batch\/v1<\/code>codecodecode endpoint, which processes multiple sub-requests in a single call by tracking them in two parallel arrays. An error in one sub-request knocks those arrays out of alignment by one position, causing a subsequent request to execute under the wrong handler \u2014 bypassing the endpoint&#8217;s allow-list entirely.<\/p>\n<p>CVE-2026-60137 is a SQL injection in WordPress core&#8217;s <code>WP_Query<\/code>codecodecode object, specifically in the <code>author__not_in<\/code>codecodecode parameter. When the parameter receives a string instead of the expected array, the validation check that would normally sanitize the input is skipped entirely, allowing the raw value to reach the database query. This injection alone affects WordPress 6.8.0 through 6.8.5, fixed in 6.8.6, but it only becomes a full RCE chain when combined with the batch-route confusion present from version 6.9 onward.<\/p>\n<h2>Version Exposure and Patch Status<\/h2>\n<p>WordPress shipped forced updates on Friday, but the company has not confirmed whether those updates reach sites that have disabled automatic updates. Administrators should verify their current version manually rather than assume the patch landed.<\/p>\n<ul>\n<li><strong>6.8.0 through 6.8.5:<\/strong> SQL injection only; fixed in 6.8.6<\/li>\n<li><strong>6.9.0 through 6.9.4:<\/strong> Full RCE chain; fixed in 6.9.5<\/li>\n<li><strong>7.0.0 through 7.0.1:<\/strong> Full RCE chain; fixed in 7.0.2<\/li>\n<\/ul>\n<p>WordPress 7.1 beta2 carries both fixes. The RCE chain is only exploitable on versions 6.9 and later, which means every exposed site is running a release less than eight months old. While WordPress powers over 500 million websites, the exact number running vulnerable versions has not been disclosed.<\/p>\n<h2>CVSS Scores and Real-World Risk<\/h2>\n<p>The scoring picture is worth close attention. WordPress&#8217;s own advisory rates the RCE chain as Critical, but the CVE record assigns CVE-2026-63030 a CVSS score of 7.5 (High). That score reflects only the data-access impact of the batch-route confusion alone, not the integrity or availability loss that code execution implies. The SQL injection carries a score above 9.1 (Critical) because it directly reaches the database. Track both CVEs independently \u2014 the label on either one does not tell the full story.<\/p>\n<p>One condition narrows the blast radius: the full code-execution path only works when the site is not running a persistent object cache such as Redis or Memcached. A default WordPress installation has no such cache, so default-install exposure remains. Sites using a persistent cache may be off this particular attack path, but that is a side effect of the architecture, not a fix, and it does not protect against the SQL injection component.<\/p>\n<p>As of July 18, the vulnerability is not on CISA&#8217;s Known Exploited Vulnerabilities catalog, and no confirmed exploitation has been reported. With the proof-of-concept now public on <a href=\"https:\/\/overcentral.com\/en\/github-api-ghost-accounts-recon\/\" title=\"Ghost Accounts Abuse GitHub API in Mass Recon Campaign\" data-iacss-internal=\"1\">GitHub<\/a> and the patch available for anyone to read, that window is closing rapidly.<\/p>\n<h2>Mitigations for Sites That Cannot Patch Immediately<\/h2>\n<p>Every mitigation strategy focuses on keeping anonymous callers away from the batch endpoint. All are stopgaps and may break legitimate integrations:<\/p>\n<ul>\n<li>At the WAF level, block both <code>\/wp-json\/batch\/v1<\/code>codecodecode and <code>rest_route=\/batch\/v1<\/code>codecodecode. Blocking only the <code>\/wp-json<\/code>codecodecode path leaves the query-string route open. Cloudflare&#8217;s managed WAF now blocks the chain for sites behind it.<\/li>\n<li>Use a plugin that disables unauthenticated REST API access entirely, such as a tool that kills anonymous REST requests wholesale.<\/li>\n<li>Deploy a short drop-in plugin that rejects anonymous <code>\/batch\/v1<\/code>codecodecode requests at the <code>rest_pre_dispatch<\/code>codecodecode hook. Searchlight has published one such plugin.<\/li>\n<\/ul>\n<p>WordPress core is open source, and the patch names the files it changed. Shipping the fix necessarily ships the map to the bug. The only remaining lever is how quickly the update reaches sites before an attacker reads the same diff. WordPress pushed hard on Friday, but with the exploit now public and the update still rolling out, the race between patching and scanning is underway.<\/p>\n<h2>What Administrators Should Do Now<\/h2>\n<p>Verify your WordPress version immediately by checking the admin dashboard or running <code>wp core version<\/code>codecodecode from the command line. If your site is on 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1, apply the update to 6.9.5 or 7.0.2 without delay. Even if you are on 6.8.x, apply 6.8.6 to close the SQL injection. If you cannot update immediately, block the batch endpoint at your WAF and monitor for unauthorized access. Enable multi-factor authentication on all admin accounts, audit active sessions, and consider a web application firewall with virtual patching capabilities. Mass exploitation of WordPress is a well-established threat, and this bug works on the default configuration with no preconditions. Treat the patch as urgent even though no active exploitation has been confirmed \u2014 the gap between public disclosure and automated scanning has historically been measured in hours, not days.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A critical unauthenticated remote code execution vulnerability chain in WordPress core, tracked as wp2shell, now has CVE identifiers, a published proof-of-concept, and a patch that went out Friday with WordPress versions 6.9.5 and 7.0.2. Two separate flaws \u2014 CVE-2026-63030, a REST API batch-route confusion, and CVE-2026-60137, a SQL injection \u2014 combine to let an anonymous [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":74679,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/iili.io\/CjPZTYB.jpg","fifu_image_alt":"wp2shell WordPress Flaw Unlocks Unauthenticated Code Execution","footnotes":""},"categories":[349],"tags":[],"class_list":["post-63885","post","type-post","status-publish","format-standard","has-post-thumbnail","category-articles"],"fifu_image_url":"https:\/\/iili.io\/CjPZTYB.jpg","fifu_image_alt":"wp2shell WordPress Flaw Unlocks Unauthenticated Code Execution","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/63885","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=63885"}],"version-history":[{"count":0,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/63885\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/74679"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=63885"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=63885"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=63885"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}