Full Report
Plus dozens of PoCs in the public domain
Analysis Summary
# Vulnerability: WP2Shell (WordPress RCE Chain)
## CVE Details
- **CVE ID:** CVE-2026-63030 (Critical), CVE-2026-60137 (Moderate)
- **CVSS Score:** 9.8 (Critical) for the chained exploit.
- **CWE:** CWE-436 (Interpretation Conflict / Route Confusion) and CWE-89 (SQL Injection).
## Affected Systems
- **Products:** WordPress Core.
- **Versions:**
- WordPress 6.8 (Affected by CVE-2026-60137 only).
- WordPress 6.9 through 6.9.4 (Affected by both).
- WordPress 7.1 Beta 1 (Affected by both).
- **Configurations:** Default settings; the exploit requires no specific plugins or non-standard configurations (stock install).
## Vulnerability Description
The flaw, dubbed **"wp2shell,"** involves chaining two separate vulnerabilities:
1. **CVE-2026-63030:** A REST API batch-route confusion bug. When processing batch requests, the arrays containing sub-requests and validation results become misaligned. This causes the system to treat unauthenticated, malicious requests as trusted/validated.
2. **CVE-2026-60137:** A SQL injection vulnerability.
When chained, an unauthenticated attacker can bypass validation via the route confusion flaw to execute the SQL injection or other privileged API actions, leading to full Remote Code Execution (RCE).
## Exploitation
- **Status:** **Exploited in the wild.** Mass exploitation observed within hours of disclosure.
- **Complexity:** Low (Trivial to reproduce, reportedly with AI assistance).
- **Attack Vector:** Network (Pre-authentication/Anonymous).
- **PoC Availability:** Highly available; dozens of unique PoCs exist in the public domain.
## Impact
- **Confidentiality:** Total (Credential exfiltration and database access).
- **Integrity:** Total (Creation of backdoor admin accounts and malicious plugins).
- **Availability:** Total (Full system takeover via RCE).
## Remediation
### Patches
Update WordPress immediately to the following versions or higher:
- **WordPress 6.8.6** (Fixes SQLi)
- **WordPress 6.9.5** (Fixes both)
- **WordPress 7.1 Beta 2** (Fixes both)
*Note: The WordPress security team has enabled forced auto-updates for many affected sites.*
### Workarounds
No specific configuration workarounds are provided in the article; immediate patching is the only recommended mitigation.
## Detection
- **Indicators of Compromise (IoCs):**
- Presence of unauthorized new administrator accounts.
- Installation of unknown or "fake" WordPress plugins.
- Presence of the **Overlord RAT** (Golang-based trojan).
- Evidence of credential exfiltration in web logs.
- **Detection Methods:**
- Use the "wp2shell checker" tool provided by Searchlight Cyber.
- Audit `wp_users` table for suspicious admin entries.
- Inspect the `/wp-content/plugins/` directory for unauthorized files.
## References
- WordPress official advisory: hxxps[://]wordpress[.]org/news/2026/07/wordpress-7-0-2-release/
- Researcher Technical Write-up: hxxps[://]wp2shell[.]com/
- Vulnerability Database Entry: hxxps[://]patchstack[.]com/database/wordpress/plugin/wordpress/vulnerability/wordpress-core-7-0-1-unauthenticated-remote-code-execution-vulnerability
- Analysis: hxxps[://]www[.]vulncheck[.]com/blog/wp2shell