Listen to this Post
The wp2shell vulnerability chain comprises two independent flaws in WordPress core. CVE-2026-63030 is a REST API batch-route confusion issue located in the /wp-json/batch/v1 endpoint. This endpoint processes multiple sub-requests within a single call and tracks them using two parallel arrays. By nesting batch requests and deliberately causing an error in one sub-request, an attacker can knock the arrays out of step by one position. This desynchronization allows a request to be executed under a different request’s handler, effectively bypassing authentication checks. The second flaw, CVE-2026-60137, is a SQL injection in the author__not_in parameter of WP_Query. When a string is supplied instead of the expected array, the type check is skipped, and the raw value is inserted directly into the SQL query. Chaining these two vulnerabilities enables an unauthenticated attacker to perform SQL injection and ultimately achieve remote code execution on a default WordPress installation. The full RCE chain affects WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The SQL injection alone affects versions 6.8.0 through 6.8.5, but cannot be chained to RCE because the batch-route confusion bug was introduced in version 6.9. WordPress patched the issues in versions 6.8.6, 6.9.5, and 7.0.2. The CVSS score is 9.8, indicating critical severity. Public proof-of-concept exploits are available, and exploitation in the wild has been observed. The attack requires no preconditions and works on stock installations with no plugins. Over 500 million websites run WordPress, but only those on the affected versions are vulnerable to the RCE chain. The patch was released on July 18, 2026, and forced automatic updates were enabled for affected sites. The vulnerability was discovered by Adam Kues of Searchlight Cyber, with the SQL injection reported separately by TF1T, dtro, and haongo.
DailyCVE Form:
Platform: WordPress
Version: 6.9.0-6.9.4, 7.0.0-7.0.1
Vulnerability: Pre-Auth RCE
Severity: Critical
date: 2026-07-17
Prediction: 2026-07-18
What Undercode Say:
go build -o wp2shell-master go-scanner/wp2shell-master.go
./wp2shell-master scan -f targets.txt -j -t 20
./wp2shell-master check https://target.com –waf –delay 3.0
./wp2shell-master read https://target.com –preset users
./wp2shell-master rce https://target.com –cmd id -y –waf –stealth
./wp2shell-master rce https://target.com -i -y
python3 waf-bypass/core.py
python3 waf-bypass/dump_version.py
python3 waf-bypass/dump_dbname.py
python3 waf-bypass/dump_tables.py
python3 waf-bypass/dump_columns.py
python3 waf-bypass/rce_shell.py
msfconsole
use exploit/multi/http/wp2shell_rce
use auxiliary/scanner/http/wp2shell_scanner
Exploit: (Educational Purposes!)
- Route confusion via nested batch requests with invalid primer path bypasses authentication.
- Time-based blind SQLi extracts table prefix, admin ID, and credentials.
- UNION-based row forgery seeds oEmbed caches (read-only SQLi to DB writes).
- Changeset elevation and re-entrant parse_request() forges an administrator.
5. Plugin upload deploys a self-cleaning webshell.
6. Command execution and automatic cleanup.
Protection: from this CVE
Update to WordPress 6.8.6, 6.9.5, or 7.0.2.
Enable forced automatic updates.
Deploy WAF rules to block nested batch requests and SQLi patterns in author__not_in.
Monitor for suspicious /wp-json/batch/v1 activity.
Apply virtual patching if immediate update is not possible.
Impact:
Full site compromise.
Unauthenticated remote code execution.
Data theft and credential harvesting.
Webshell deployment and persistent access.
Lateral movement within hosting environments.
Mass exploitation potential due to 500 million WordPress installs.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
