CVE-2026-63030 / CVE-2026-60137 — "wp2shell" WordPress Core RCE Chain

Discoverer: Searchlight Cyber (via GPT-5.6 Sol)
Severity: Critical — CVSS 9.8 (CVE-2026-63030), CVSS 9.1 (CVE-2026-60137)
Status: Actively exploited — added to CISA KEV
Alias: "wp2shell"

Overview

This is an unauthenticated remote code execution chain in WordPress Core composed of two CVEs:

Individually each flaw is serious; combined they allow an unauthenticated attacker to execute arbitrary PHP on the target and deploy webshells.

Technical Details

CVE-2026-63030 — Batch Endpoint Route Confusion

The WordPress REST API exposes a batch endpoint at /wp-json/wp/v2/batch. Due to a flaw in route resolution (introduced in WP 6.9's rewritten routing middleware), the batch processor does not correctly validate that internal sub-requests in a batch inherit the authentication and permission checks of the outer request. An attacker can craft a batch payload that:

1. Escapes the route namespace boundary.
2. Invokes privileged endpoints (e.g. wp/v2/users, wp/v2/plugins) without the required capability checks.
3. Leverages WP_REST_Server::dispatch() to pass forged route parameters to internal handlers.

This bypasses all authentication guards for read operations and some write operations when combined with parameter smuggling.

CVE-2026-60137 — author__not_in SQL Injection

The WP_Query class accepts an author__not_in parameter intended to exclude posts by specific author IDs. A type-coercion bug in the WP_Query::get_posts() method (introduced in WP 6.9's query sanitization refactor) causes author__not_in values to be interpolated directly into the SQL WHERE clause without proper parameterisation when supplied as a specially crafted associative array.

The injection occurs in the post_author IN (...) generated SQL. By nesting arrays with raw SQL fragments an attacker can break out of the IN clause and execute arbitrary UNION / INTO OUTFILE statements — provided the database user has FILE privilege.

Combined Chain

Attacker (unauthenticated)
  │
  ├─ POST /wp-json/wp/v2/batch
  │    └─ CVE-2026-63030: Bypass auth, invoke internal query API
  │         └─ CVE-2026-60137: Inject SQL via author__not_in
  │              └─ UNION SELECT ... INTO OUTFILE 'webshell.php'
  │                   └─ Webshell deployed to web root
  │                        └─ RCE achieved

The batch endpoint provides the vector; the SQLi provides the payload delivery.

Affected Versions

Patches were shipped in WordPress 6.9.5 and 7.0.2 (both issued 2026-07-16).

Reproduction Steps

1. Confirm target WordPress version is in the affected range.
2. Verify /wp-json/wp/v2/batch returns 200 (not 403/404).
3. Run the PoC with the --target flag (see below).
4. Confirm webshell at /wp-content/webshell.php?cmd=id.

PoC Usage

python exploit.py --target https://target.example.com --action deploy-webshell
python exploit.py --target https://target.example.com --action exec --command "id"
python exploit.py --target https://target.example.com --action exec --command "uname -a"

Mitigation

• Upgrade to WordPress 6.9.5+ or 7.0.2+.
• If immediate patching is impossible:
  • Block POST /wp-json/wp/v2/batch at the WAF / reverse proxy.
  • Remove FILE privilege from the WordPress MySQL user.
  • Enable define('DISALLOW_FILE_EDIT', true); and define('DISALLOW_FILE_MODS', true);.
• Monitor for unexpected .php files under wp-content/.
• Check for author__not_in with non-integer values in request logs.

References

• [Searchlight Cyber Advisory — "wp2shell"] (https://searchlightcyber.com/advisories/wp2shell)
• CVE-2026-63030 — NVD
• CVE-2026-60137 — NVD
• CISA Known Exploited Vulnerabilities Catalog
• WordPress Core 6.9.5 Release Notes