First Seen: July 2026

Affected Products: WordPress Core 6.8.x, 6.9.x, and 7.0.x (7.1 beta also affected)

WordPress Core, which powers more than 500 million websites, is exposed to a serious flaw chain called wp2shell that lets a remote attacker take over a site with a single web request, with no login or plugins needed. wp2shell combines two bugs: CVE-2026-63030, a REST API batch-route confusion introduced in WordPress 6.9, and CVE-2026-60137, a SQL injection in the author__not_in parameter of WP_Query. On WordPress 6.9 and 7.0, the two chain together into full remote code execution. WordPress released fixes (7.0.2, 6.9.5, 6.8.6, and 7.1 beta2) on July 17, 2026, and switched on forced auto-updates, but working exploits are already circulating on GitHub, so any WordPress Core site not yet confirmed on a patched version should be updated immediately.

CVEs at a Glance

#1 — A Zero-Precondition Chain in WordPress Core

wp2shell is not a single vulnerability but a chain of two distinct weaknesses in WordPress core that, when combined, allow an anonymous attacker to move from an ordinary web request to remote code execution. Researchers describe an attack with no preconditions: it needs no login, no plugins, and no special settings, only a reachable WordPress Core site running an affected version. That combination of zero prerequisites and a target base measured in the hundreds of millions of sites is what makes the wp2shell chain so significant.

#2 — CVE-2026-63030: REST API Batch-Route Confusion

The first flaw in the chain, CVE-2026-63030, is a REST API batch-route confusion weakness that WordPress rates as critical. The batch endpoint is a long-standing feature that has shipped since WordPress 5.6 and lets clients bundle several REST calls into one request, but a change introduced in the WordPress 6.9 release created a route-handling confusion that an unauthenticated caller can abuse.

#3 — CVE-2026-60137: SQL Injection in WP_Query

The second flaw, CVE-2026-60137, is a SQL injection vulnerability in the author__not_in parameter of the WP_Query class, mapped to CWE-89 and scored CVSS 3.1 9.1. WordPress does not properly sanitize this parameter, so untrusted input reaching it can be used to inject arbitrary SQL, driven by the potential to both read and modify database contents over the network without authentication. The vendor's own advisory labels this issue as moderate in isolation, reflecting that, on its own, it depends on how a given WordPress Core site exposes the parameter.

#4 — How the Chain Interlocks

On WordPress 6.9 and later, the batch-route confusion gives an anonymous request a way to reach code paths that feed the vulnerable query logic, turning the SQL injection into a remotely triggerable primitive that ultimately yields code execution. On WordPress 6.8 the SQL injection is present but cannot be chained this way, because the batch-route confusion bug did not exist before 6.9, so 6.8 sites face data exposure rather than full compromise.

#5 — Scope, Fixed Versions, and Forced Updates

The complete wp2shell remote code execution chain affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, while the SQL injection issue alone reaches back to 6.8.0 through 6.8.5. Fixes landed in WordPress 7.0.2 and 6.9.5, with 6.8.6 addressing the SQL injection on the older branch and 7.1 beta2 covering the pre-release line. The 7.0.2 update touched three core files tied to REST request handling and query construction, and WordPress enabled forced background updates so that many affected sites would be patched automatically.

#6 — Public Proof-of-Concept Exploits

Multiple proof-of-concept exploits for wp2shell were posted to GitHub. Some abuse the SQL injection to extract WordPress password hashes, crack an administrator credential offline, then log in, upload a malicious plugin, and run commands, while others claim true pre-authentication code execution against WordPress Core without any credentials, matching the researchers' original description.

Affected Versions, CPEs, and CWEs

Patch Link

• https://wordpress.org/news/2026/07/wordpress-7-0-2-release/

References

• https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
• https://socradar.io/blog/wp2shell-wordpress-rce-cve-2026-63030/
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q