Full Report
WP2Shell is a critical WordPress Core exploit chain disclosed in July 2026 that can enables pre-authentication remote code execution (RCE) on vulnerable WordPress installations. The chain is particularly significant from a threat-intelligence perspective because it removes the requirement for an attacker to first obtain valid credentials or authenticate to the target application. The exploitation chain […] The post WP2Shell Exploit Chain: Anatomy of a Sophisticated WordPress Attack appeared first on Seqrite Labs.
Analysis Summary
# Vulnerability: WP2Shell, Pre-Authentication RCE Chain in WordPress Core
> **Note:** The source article is truncated. Fields marked "Not stated" were not in the provided text and should be verified against the official WordPress security advisories or CVE records before use.
## CVE Details
- **CVE ID:** CVE-2026-63030 (REST API route confusion) and CVE-2026-60137 (SQL injection), chained together
- **CVSS Score:** Not stated. Verify with NVD or the WordPress advisories.
- **CWE:** Not stated. The SQL injection would typically map to CWE-89, but this is inferred, not confirmed by the article.
## Affected Systems
- **Products:** WordPress Core
- **Versions:**
- Vulnerable: 6.9.0–6.9.4 and 7.0.0–7.0.1 (explicitly stated as exposed to the complete chain)
- Article also refers generally to "WordPress 6.9.x and 7.0.x installations"
- Fixed releases: 6.8.6, 6.9.5, 7.0.2
- *Unclear:* Whether 6.8.x was vulnerable. A 6.8.6 fix is listed, but the article does not say 6.8.x branches were affected. Check the advisory.
- **Configurations:** Publicly reachable WordPress sites with the REST API exposed. The `/wp-json/batch/v1` endpoint and the posts endpoint's `author_exclude` parameter are the relevant attack surface. No plugin or non-default configuration requirement is stated.
## Vulnerability Description
WP2Shell chains two WordPress Core flaws:
1. **CVE-2026-63030 (REST API route confusion):** The REST API batch controller (`/wp-json/batch/v1`) resolves and dispatches nested batch requests incorrectly. An unauthenticated attacker can embed an inner batch structure in an outer request to reach REST handlers that normally require authentication. This flaw alone does not give code execution.
2. **CVE-2026-60137 (SQL injection):** The public `author_exclude` parameter on the posts endpoint maps to `author__not_in` in `WP_Query`. Insufficient input handling lets crafted values alter the SQL query. On its own, this is a database-layer issue without direct code execution.
**Chain:** CVE-2026-63030 provides unauthenticated access to the code path containing CVE-2026-60137. The SQL injection is then used to move from database access to arbitrary code execution on the server.
## Exploitation
- **Status:** Not stated in the provided text. Confirm whether in-the-wild exploitation has been reported.
- **PoC Availability:** Not stated in the provided text.
- **Complexity:** Not explicitly stated. The pre-authentication requirement suggests a low barrier to entry, but the chaining logic makes it more involved than a single-bug exploit.
- **Attack Vector:** Network. The attack starts from the publicly exposed WordPress application.
## Impact
- **Confidentiality:** High (inferred). SQL injection enables database read access, and RCE enables file access.
- **Integrity:** High (inferred). RCE permits arbitrary code execution and modification of site files and data.
- **Availability:** High (inferred). Attacker-controlled code can disrupt or take down the site.
*Impact levels are inferred from the described RCE and SQLi capabilities, not from a stated CVSS vector.*
## Remediation
### Patches
- WordPress **6.8.6** (fixed)
- WordPress **6.9.5** (fixed)
- WordPress **7.0.2** (fixed)
- Or a later supported release
### Workarounds
- Restrict unauthenticated access to the REST API, particularly `/wp-json/batch/v1` and posts queries using `author_exclude`, where operationally feasible.
- Apply WAF rules to block or inspect requests to the batch endpoint with nested batch structures and to `author_exclude` values containing SQL metacharacters. Specific rule content is not provided in the article.
- Restrict or monitor external access to the WordPress installation until patching is complete.
## Detection
**Indicators of Compromise (from the article):**
- Unexpected or newly created PHP files, especially in plugin directories
- Recently created or modified application files during the suspected exploitation window
- Suspicious plugin directories
- Anomalous administrator accounts
- Other filesystem or application-level changes
**Network indicators to hunt:**
- HTTP requests to `/wp-json/batch/v1` containing nested batch structures
- Requests to the posts endpoint with `author_exclude` values containing SQL syntax
- Scanning activity against `/wp-json/` endpoints (MITRE T1595.002)
**Detection tools and signatures (Quick Heal):**
- Behavioural: `SL_A WP2Shell Suspicious PHP File Modification in WordPress Plugins`
- Network: `HTTP/CVE-2026-63030!DP.50405`
- Network: `HTTP/CVE-2026-63030!SP.50370`
**MITRE ATT&CK mapping:**
- T1595.002 (Active Scanning: Vulnerability Scanning)
- T1190 (Exploit Public-Facing Application)
## References
- Seqrite Labs, "WP2Shell Exploit Chain: Anatomy of a Sophisticated WordPress Attack" (Amruta Wagh, 16 October 2026): hxxps://www[.]seqrite[.]com/blog/wp2shell-exploit-chain-anatomy-of-a-sophisticated-wordpress-attack/ *(URL inferred from the article's category path; verify)*
- WordPress Core security releases 6.8.6, 6.9.5, and 7.0.2: hxxps://wordpress[.]org/news/ *(verify the specific advisory)*
- NVD entries for CVE-2026-63030 and CVE-2026-60137: hxxps://nvd[.]nist[.]gov/ *(verify)*