FlagThis - Latest Cybersecurity News

A critical exploit chain dubbed "WP2Shell" enables unauthenticated remote code execution (RCE) in WordPress Core by chaining a REST API batch-route confusion vulnerability (CVE-2026-63030) with a SQL injection in the WP_Query author__not_in parameter (CVE-2026-60137). Attackers leverage the /wp-json/batch/v1 endpoint to bypass security controls and trigger the SQLi vector, achieving RCE on default installations lacking a persistent object cache. Immediate remediation requires updating to WordPress versions 6.9.5 or 7.0.2+.

WordPress Core is affected by a critical RCE chain dubbed "wp2shell," combining CVE-2026-60137 (SQL injection in WP_Query's author__not_in parameter) and CVE-2026-63030 (REST API batch-route confusion). Unauthenticated remote attackers can exploit the /wp-json/batch/v1 endpoint to bypass security controls and execute arbitrary code without user interaction or plugin dependencies. The vulnerability is exacerbated in environments lacking persistent object caching. Immediate remediation requires updating to versions 6.9.5, 7.0.2, or 7.1 Beta 2. Active exploitation is confirmed, with AI-assisted tools accelerating PoC development and patch diffing.