WordPress Core 'wp2shell' RCE Flaws See Public Exploits, Urgent Patching Advised

Critical remote code execution (RCE) vulnerabilities, collectively dubbed "wp2shell," have been discovered in WordPress Core, and public exploits are now readily available, significantly escalating the risk for website administrators. The "wp2shell" attack chain involves two distinct flaws, CVE-2026-63030 and CVE-2026-60137, which can be chained together by an unauthenticated attacker to achieve pre-authentication RCE on WordPress installations running versions 6.9.x and 7.0.x.

The vulnerabilities were identified by Searchlight Cyber's security research team. They noted that the attack has no preconditions and can be exploited against a default WordPress installation without any additional plugins. Given that WordPress powers an estimated 500 million websites globally, the potential impact of these flaws is immense, especially with the release of public proof-of-concept exploits.

In response to the severity of the vulnerabilities, the WordPress security team has activated forced automatic security updates for supported installations running the affected versions. Site owners are strongly urged to update to WordPress 7.0.2 or 6.9.5 immediately. The WordPress.org team stated, "Because this is a security release, it is recommended that you update your sites immediately." They further emphasized the forced update mechanism for affected sites.

The "wp2shell" attack is not a single vulnerability but a combination of two independent flaws. The first, CVE-2026-63030, is a REST API batch-route confusion vulnerability introduced in WordPress 6.9. This flaw, when combined with a SQL injection issue, can lead to remote code execution. The second vulnerability, CVE-2026-60137, is a high-severity SQL injection flaw within the 'author__not_in' parameter of 'WP_Query', affecting WordPress 6.8 and later versions.

The complete RCE chain affects WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. While the SQL injection vulnerability alone impacts WordPress 6.8.0 through 6.8.5, it cannot be chained for RCE without the REST API batch-route confusion bug, which was introduced in WordPress 6.9. The fixes are available in WordPress 6.9.5 and 7.0.2.

Searchlight Cyber has initially withheld full technical details to allow administrators time to patch, instead launching wp2shell.com to help site owners test their vulnerability. For those unable to update immediately, temporary mitigations include installing a plugin to block anonymous REST API access or using a Web Application Firewall (WAF) to block specific API endpoints. Cloudflare has already deployed WAF protections for both vulnerabilities across its platform.

Despite Searchlight Cyber's efforts to delay full disclosure, multiple public proof-of-concept exploits have surfaced on GitHub. Some exploits demonstrate extracting password hashes via SQL injection to gain administrative access, while others claim to achieve pre-authentication RCE directly. Security firm watchTowr has reported observing in-the-wild exploitation following the release of these public exploits, highlighting the immediate threat.

Given the availability of public exploits and confirmed in-the-wild activity, it is critical for all WordPress administrators to update their sites to the patched versions, 7.0.2 or 6.9.5, as soon as possible to prevent potential compromise.

The WP2Shell vulnerabilities, CVE-2026-60137 and CVE-2026-63030, are now confirmed to be actively exploited in the wild, with attacks commencing shortly after their public disclosure. Threat actors are chaining these flaws to achieve unauthenticated remote code execution, posing an immediate and significant risk to WordPress websites globally. WordPress developers have enabled forced updates for affected versions to mitigate the threat.

This new report details how the AI model GPT-5.6 Sol Ultra independently discovered the 'wp2shell' RCE vulnerability, outlining the specific exploit chain involving the Batch API and post caching mechanisms. The AI's process, which cost approximately $25 in compute time, highlights a new paradigm in vulnerability research where AI models can discover complex, multi-stage exploits without human intervention, potentially accelerating the discovery of critical flaws in widely used software like WordPress.

This new report details how researchers leveraged OpenAI's GPT5.6 Sol Ultra model to automate the discovery of a complex, multi-stage exploit chain for these WordPress Core vulnerabilities, a feat they claim would have taken human researchers weeks or months. The AI-driven process, costing approximately $25, successfully escalated a SQL injection into pre-authentication remote code execution by manipulating cache entries and WordPress customizations to upload a backdoor plugin.

This Tenable blog post provides a frequently asked questions (FAQ) format to elaborate on the 'wp2shell' vulnerability chain, detailing the specific CVEs involved (CVE-2026-63030 and CVE-2026-60137) and their combined impact. It clarifies that the exploit chain is unique in targeting WordPress Core directly, unlike previous KEV entries which focused on plugins, and notes that exploitation is facilitated by AI-assisted tooling for rapid exploit development.

The SANS Internet Storm Center report provides further technical details on the exploitation of WordPress Core vulnerability CVE-2026-63030, dubbed 'wp2shell'. It includes a full exploit request demonstrating how attackers use a UNION request to inject malicious PHP code, ultimately writing a webshell to '/var/www/wp-content/cache/94uh9ubh6e1x.php'. This confirms the potential for unauthenticated remote code execution via the REST API.

This new report from Wordfence provides a deeper dive into the wp2shell vulnerability chain, detailing the specific CVEs involved (CVE-2026-60137 and CVE-2026-63030) and the technical mechanism by which the SQL injection and REST API route confusion can be chained for unauthenticated remote code execution. It also highlights that while WordPress 6.9.x and 7.0.x are vulnerable to the full RCE chain, 6.8.x is only susceptible to the SQL injection component, and confirms that exploitation activity began within hours of the patch release.

This new report details the active exploitation of WordPress core vulnerabilities CVE-2026-60137 and CVE-2026-63030, dubbed 'WP2Shell,' which allow for unauthenticated remote code execution. The exploitation chain, discovered with the assistance of AI, began just three days after disclosure and affects millions of sites, with attackers already creating backdoor accounts and deploying malicious plugins.

Exploitation of the wp2shell vulnerabilities (CVE-2026-63030 and CVE-2026-60137) has significantly intensified following the release of public exploit code. Attackers are now engaging in mass scanning and have been observed uploading malicious plugins, enumerating users, performing local file inclusion attacks to steal credentials, and successfully authenticating to admin panels. In some instances, threat actors have attempted to install the Golang-based remote access trojan Overlord RAT, and a sophisticated web shell disguised as a legitimate security plugin has been deployed, offering extensive post-exploitation capabilities.

This new report from Malwarebytes Labs shifts focus from the technical exploitation of WordPress Core's wp2shell vulnerability chain to the potential impact on end-users visiting compromised websites. It details how attackers leverage the administrative control and remote code execution capabilities granted by the vulnerability to deliver scams, steal credentials through fake login pages, distribute malware, and redirect visitors to malicious infrastructure, even after the core vulnerabilities have been patched.

This new report provides further technical details on observed exploitation patterns, including mass-scanning for vulnerable sites, the abuse of WordPress's plugin upload functionality, and the deployment of various webshells. It also details attempts to query the REST API for administrator credentials and local file inclusion attempts to steal database credentials and authentication keys, alongside the creation of rogue administrator accounts.

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog to include CVE-2021-27137 affecting DD-WRT, and CVE-2026-0770 impacting Langflow. This expands the catalog beyond the previously reported WordPress vulnerabilities (CVE-2026-63030 and CVE-2026-60137) that were already covered, highlighting a broader range of actively exploited software.

The Patchstack Blog provides a detailed chronological account of the exploitation campaign, revealing that attackers began weaponizing the WordPress core RCE vulnerabilities (CVE-2026-60137 and CVE-2026-63030) within 90 minutes of the patch release. Their analysis shows over 65,000 exploitation attempts blocked from more than 1,500 unique IP addresses in the days following disclosure, indicating a rapid, widespread, and opportunistic attack landscape rather than a coordinated operation.