wp2shell: Pre-Auth RCE in WordPress Core

A pre-authentication remote code execution chain in WordPress core. If you run an affected version, update to 7.0.2 (or 6.9.5, or 6.8.6) immediately.

wp2shell is a chain of two WordPress core flaws: a REST API batch-route confusion bug (CVE-2026-63030) and a SQL injection in WP_Query’s author handling (CVE-2026-60137). Chained together, they let an unauthenticated attacker poison cached post objects, forge an administrator account, install a plugin, and run code on the server as the web user. It needs no login, no plugins, and no special configuration. A stock install on an affected version is enough. Public proof-of-concept exploits are out, and in-the-wild exploitation is confirmed.

• Affected versions: 6.9.0–6.9.4 and 7.0.0–7.0.1
• Only SQLi: 6.8.x
• Fixes are branch-specific: 7.0.2, 6.9.5, or 6.8.6
• WordPress.org forced auto-updates for affected versions, so many sites are already patched. However, forced updates fail silently on installs with background updates disabled, version-controlled deployments, etc.
• If you cannot patch:
  • Block /wp-json/batch/v1
  • Block ?rest_route=/batch/v1
  • OR – disable anonymous REST API access
• Checking for compromise: review HTTP access logs, and look for unfamiliar plugins/PHP files – even after patching/blocking.
• WordPress 7.0.2 release – official security release post
• Searching Cyber write-up – reported by Adam Kues; free exposure checker at wp2shell.com
• Elastic Security Labs – end-to-end detection write-up

Photo by Gabriel Heinzer on Unsplash