WordPress Core: Critical wp2shell RCE CVE-2026-63030

WordPress Core is affected by a critical RCE chain dubbed "wp2shell," combining CVE-2026-60137 (SQL injection in WP_Query's author__not_in parameter) and CVE-2026-63030 (REST API batch-route confusion). Unauthenticated remote attackers can exploit the /wp-json/batch/v1 endpoint to bypass security controls and execute arbitrary code without user interaction or plugin dependencies. The vulnerability is exacerbated in environments lacking persistent object caching. Immediate remediation requires updating to versions 6.9.5, 7.0.2, or 7.1 Beta 2. Active exploitation is confirmed, with AI-assisted tools accelerating PoC development and patch diffing.

• Overview: The wp2shell Exploit Chain

  • Combines two distinct vulnerabilities to achieve full server compromise.
  • Targets default WordPress installations; no third-party plugins are required for execution.
  • Affects an estimated 500 million+ websites globally due to the prevalence of WordPress Core.

• Technical Deep Dive: Vulnerability Mechanics

  • CVE-2026-60137: A medium-severity SQL injection located in the author__not_in parameter of the WP_Query class.
  • CVE-2026-63030: A critical route confusion flaw within the REST API batch endpoint introduced in version 6.9.
  • Primary attack vector utilizes the /wp-json/batch/v1 or ?rest_route=/batch/v1 endpoints to trigger the RCE.

• Exploitation Status & AI Acceleration

  • Confirmed active in-the-wild exploitation by security firms Patchstack and Hexastrike.
  • Rapid proliferation of public Proof-of-Concept (PoC) exploits across GitHub.
  • Threat actors are utilizing advanced AI models (e.g., GPT-5.6) to accelerate patch diffing and refine exploit payloads.

• Environmental Factors & Impact

  • Vulnerability path is significantly more reachable in environments where a persistent object cache is not implemented.
  • Attack complexity is rated as low; requires no authentication, no login, and zero user interaction.
  • Successful exploitation leads to full website takeover, sensitive data compromise, and complete server-level access.

• Remediation & Mitigation

  • Branch 6.9 installations must be upgraded to version 6.9.5 immediately.
  • Branch 7.0 installations must be upgraded to version 7.0.2.
  • Beta testers on branch 7.1 must upgrade to 7.1 Beta 2.