Critical Vulnerability Chain in WordPress Core Under Exploitation (wp2shell)

Successful exploitation of CVE-2026-63030 and CVE-2026-60137 could allow an unauthenticated attacker to execute code remotely

Threat ID:: CC-4815
Threat Severity:: High
Published:: 20 July 2026 11:35 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Successful exploitation of CVE-2026-63030 and CVE-2026-60137 could allow an unauthenticated attacker to execute code remotely

Affected platforms

The following platforms are known to be affected:

WordPress Core

versions 6.8.0 to 6.8.5
versions 6.9.0 to 6.9.4
versions 7.0.0 to 7.0.1

Note: WordPress Core releases 6.8 and 6.9 are end-of-life and are not officially supported nor actively maintained.

Threat details

Exploitation of CVE-2026-63030 and CVE-2026-60137 reported

Security researchers have reported exploitation of the wp2shell exploit chain, and a public proof-of-concept exploit is available. The NHS England National CSOC assesses further exploitation as highly likely.

Introduction

Security researchers have disclosed a pre-authentication remote code execution (RCE) vulnerability chain in WordPress Core.

CVE-2026-63030 - Interpretation Conflict vulnerability - CVSSv3 score: 9.8
CVE-2026-60137 - SQL Injection vulnerability - CVSSv3 score: 5.9

CVE-2026-63030 and CVE-2026-60137 can be chained together to achieve unauthenticated remote code execution through crafted API requests.

Remediation advice

Affected organisations must review security advisories GHSA-ff9f-jf42-662q and GHSA-fpp7-x2x2-2mjf, and complete the remediation steps detailed below.

Remediation steps

Type	Step
Patch	Required: Patch to a fixed version Affected organisations must patch their WordPress Core instance to a fixed, supported version: version 7.0.2 or later version 7.1 beta2 or later Note: Patches have been released for WordPress Core releases 6.8 and 6.9, however these releases are end-of-life, and are no longer officially supported nor actively maintained. Organisations must migrate to a supported release. https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
Action	Recommended: Block anonymous access to the WordPress REST API Organisations are recommended to block anonymous access to the WordPress REST API by either: Installing a plugin that blocks anonymous access to the REST API entirely. Blocking /wp-json/batch/v1 and ?rest_route=/batch/v1 in your web application firewall (WAF). Note: Both of these solutions may have an impact on legitimate use of your WordPress site. https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core

Type

Step

Patch

Required: Patch to a fixed version

Affected organisations must patch their WordPress Core instance to a fixed, supported version:

version 7.0.2 or later
version 7.1 beta2 or later

Note: Patches have been released for WordPress Core releases 6.8 and 6.9, however these releases are end-of-life, and are no longer officially supported nor actively maintained. Organisations must migrate to a supported release.

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q

Action

Recommended: Block anonymous access to the WordPress REST API

Organisations are recommended to block anonymous access to the WordPress REST API by either:

Installing a plugin that blocks anonymous access to the REST API entirely.
Blocking /wp-json/batch/v1 and ?rest_route=/batch/v1 in your web application firewall (WAF).

Note: Both of these solutions may have an impact on legitimate use of your WordPress site.

https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core

Definitive source of threat updates

CVE Vulnerabilities

Status Published

CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Status Published

CVE-2026-60137

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Last edited: 20 July 2026 11:35 am