Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to analysis by Seqrite researcher Amruta Wagh.
Dubbed WP2Shell, the exploit chain reportedly emerged in July 2026 and combines REST API route confusion with SQL injection, allowing attackers to progress from public endpoints to server compromise without possessing valid WordPress credentials.
The reported chain affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Its significance lies in bypassing the initial account compromise normally required for administrative actions, creating an exploitation path directly from an exposed website.
Critical WordPress Flaws
The first vulnerability, CVE-2026-63030, affects the REST API batch controller exposed through /wp-json/batch/v1. This functionality processes multiple API requests submitted within a single JSON payload.
According to Seqrite, nested batch structures can confuse route resolution and dispatch requests to unintended handlers.
Attackers can consequently reach functionality that would otherwise require authentication. The vulnerability does not independently execute code; it supplies the unauthenticated entry point needed for the second stage.
That stage exploits CVE-2026-60137, an SQL injection vulnerability involving the posts endpoint. The public author_exclude parameter maps internally to the author__not_in argument in WP_Query. Insufficient input handling allows crafted values to influence database queries.
Combining these weaknesses enables database manipulation through the exposed batch interface. The demonstrated exploitation sequence establishes an administrator account before deploying a malicious plugin containing a web shell.
Code execution therefore follows a multistage compromise rather than arising directly from route confusion alone. The documented staging activity begins with temporary files matching temp-write-test-* beneath wp-content/, apparently checking directory writability. These files are subsequently removed.
Next, a ZIP archive, such as wp2shell_4e9b3641.zip, is staged under wp-content/uploads/2026/10/. Extraction writes PHP payloads beneath wp-content/upgrade/wp2shell_, before the plugin directory moves into wp-content/plugins/wp2shell_.
In the observed environment, httpd.exe performed these writes. Although legitimate plugin installation can generate similar filesystem activity, WP2Shell filenames, unexpected PHP files, and newly created administrator accounts provide useful investigative leads.
Defenders should correlate these artifacts with HTTP POST requests to the batch endpoint and suspicious nested API payloads. The supplied report describes proof-of-concept and laboratory behavior, rather than establishing widespread exploitation.
Affected Versions and Mitigation
The supplied version matrix identifies WordPress 6.8.0 through 6.8.5 as affected by the SQL injection vulnerability, but not the complete chain. It lists 6.8.6, 6.9.5, and 7.0.2 as fixed releases.
Administrators should prioritize the appropriate supported update, review administrator accounts, and investigate suspicious plugin directories and PHP modifications.
Where operationally feasible, restricting unauthenticated access to sensitive REST API functionality can reduce exposure while remediation proceeds.
Patching should accompany compromise assessment because previously installed web shells or unauthorized accounts may remain after vulnerable components are updated.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
