wp2shell: The WordPress Pre-Auth RCE That Let Attackers In Without Credentials

CVE-2026-63030 & CVE-2026-60137 | July 2026

What Happened

In July 2026, security researchers dropped a bombshell. WordPress Core had a critical vulnerability that let attackers get a shell on your server. No login needed. No plugins required. No user interaction.

Just pure, unauthenticated remote code execution (RCE) on a default WordPress install.

The vulnerability chain got dubbed wp2shell, and it worked by chaining two separate flaws together. Let’s break it down.

The Two Flaws Behind wp2shell

Flaw #1: REST API Route Confusion (CVE-2026-63030)

WordPress 6.9 introduced a new batch processing feature for the REST API. The idea was solid – let developers send multiple API requests in one HTTP call to save overhead.

The implementation had a problem.

When WordPress processed batch requests, it could get confused about which route handler was supposed to run. A subrequest meant for one endpoint could execute under the context of a completely different route.

Think of it like this: you send a letter to your bank, but the postal service delivers it to your ex’s house, and they open it thinking it’s theirs. The routing got mixed up.

Flaw #2: SQL Injection in WP_Query (CVE-2026-60137)

Separately, WordPress had a SQL injection bug in the WP_Query class. Specifically, the author__not_in parameter wasn’t properly sanitizing input when it expected author IDs.

On its own, this was bad. SQL injection means attackers can mess with your database.

Combined with the REST API confusion? It became a full RCE.

How the Attack Worked

Here’s the chain in plain terms:

1. Attacker sends a crafted batch request to the WordPress REST API
2. Route confusion kicks in – the request gets processed under the wrong route context
3. SQL injection payload executes – via the confused author__not_in parameter
4. Attacker gains database access – they can now read and write to wp_options
5. PHP code execution – by modifying certain options, attackers execute arbitrary PHP

No authentication required. The REST API batch endpoint is public by default.

Affected Versions

Fixed versions: 6.8.6, 6.9.5, 7.0.2

Remediation Steps

Immediate Actions

1. Update WordPress NOW
   “`bash
   # Check your version first
   wp core version

# Update via CLI
wp core update –version=7.0.2
“`

Or use wp-admin → Dashboard → Updates

1. Verify the update actually happened
2. Don’t assume automatic updates worked
3. Check wp-admin dashboard shows current version

4. Manual installs can fail silently

5. Rotate all credentials

6. Database passwords
7. WordPress salts and keys
8. Admin passwords
9. FTP/SFTP access
10. SSH keys if server-level access was possible

Forensic Checks

If you were running vulnerable versions:

# Check access logs for suspicious REST API batch requests
grep -r "wp-json/wp/v2/posts" /var/log/nginx/*.log | grep -i "batch"

# Look for unusual wp_options changes
wp option list --search="*" | grep -E "php|exec|base64"

# Check for unexpected admin users
wp user list --role=administrator

Long-term Hardening

1. Block REST API batch requests at WAF level (if you don’t use batch operations)
2. Monitor wp_options table changes – set up alerts
3. Enable two-factor authentication for all admin accounts
4. Use Web Application Firewall (WAF) with WordPress-specific rules
5. Implement file integrity monitoring on core WordPress files

Why This Matters

wp2shell represents a shift in how we think about WordPress security.

Before this, most critical WordPress vulnerabilities required:
– A compromised plugin
– Admin-level access
– User interaction (phishing, social engineering)

wp2shell needed none of that.

It targeted WordPress Core directly. It worked on fresh installs. It required zero authentication.

The lesson? Core software updates aren’t optional.

Timeline

The gap between patch availability and public exploit was less than 24 hours.

Key Takeaways

1. Update immediately when security releases drop – the exploit window is tiny
2. Verify updates – don’t trust auto-update without checking
3. Layer your defenses – WAF, monitoring, least-privilege access
4. Assume breach if you ran vulnerable versions uncovered

wp2shell proved that even mature platforms like WordPress can have critical flaws in Core. Stay patched. Stay vigilant.