WordPress Core Flaws Risk Unauth Access

A critical security vulnerability impacting WordPress core has placed millions of sites at risk by allowing unauthenticated remote code execution. The flaw, identified as a two-part exploit chain dubbed wp2shell, enables an anonymous HTTP request to execute arbitrary code on a default installation without requiring existing plugins or specific site configurations.

The Mechanics of wp2shell

The vulnerability chain consists of two distinct flaws, both of which have been assigned CVE identifiers. CVE-2026-63030 involves a REST API batch-route confusion, while CVE-2026-60137 is a SQL injection located within the WordPress core. By chaining these bugs, an attacker can bypass standard authentication mechanisms to achieve execution.

The SQL injection occurs within the WP_Query author__not_in parameter. If provided with a string rather than the expected array, the validation logic is bypassed, allowing raw input to be injected directly into the query. The batch-route confusion, which has existed in the /wp-json/batch/v1 endpoint since version 5.6 in 2020, facilitates access to this parameter by causing sub-requests to run under the incorrect handler, effectively walking past existing allow-lists.

Version-Specific Exposure

Because the batch-route confusion was introduced in version 6.9, the impact of the exploit chain depends heavily on the specific WordPress version running. Vulnerability ranges are split as follows:

• 6.8.0 through 6.8.5: Affected by SQL injection only; patched in 6.8.6.
• 6.9.0 through 6.9.4: Affected by full RCE chain; patched in 6.9.5.
• 7.0.0 through 7.0.1: Affected by full RCE chain; patched in 7.0.2.

The 7.1 beta2 release includes fixes for both issues. WordPress pushed updates on Friday to address these flaws, implementing forced updates for affected systems.

Disclosure and Technical Documentation

The batch-route bug was discovered by Adam Kues at Assetnote and reported via the HackerOne program. The SQL injection was reported by TF1T, dtro, and haongo. Following the release of the patches, a working proof-of-concept was made available on GitHub.

The writeup, published under the name wp2shell, says the attack has "no preconditions and can be exploited by an anonymous user."

The vulnerability's blast radius is partially constrained by server-side configurations. According to Cloudflare, the code-execution path functions only on sites that are not utilizing a persistent object cache. While this provides a layer of protection for some configurations, it does not mitigate the underlying SQL injection risk.

Implications for Site Security

The divergence between the perceived severity and the vulnerability scoring highlights the complexity of this incident. While the RCE chain is considered critical, the CVE record scores the RCE component as 7.5, or High, while the SQL injection carries a score higher than 9.1. Because the patch information is now public, the speed of adoption remains the primary defense against mass exploitation.

For administrators unable to apply the updates immediately, temporary mitigations include blocking access to the /wp-json/batch/v1 endpoint via a Web Application Firewall or utilizing a drop-in plugin to reject anonymous requests. As the exploit is already public, the security of individual sites will likely be determined by the speed of patch deployment relative to the activity of automated scanning tools.