wp2shell: unauthenticated code execution in WordPress core
Published
On 17 July 2026 WordPress shipped 6.9.5 and 7.0.2. They fix wp2shell, a chain combining CVE-2026-63030 (batch API route confusion, CVSS 9.8) and CVE-2026-60137 (SQL injection, CVSS 5.9). Together they deliver unauthenticated remote code execution on a default install. Public proof-of-concept exploits circulated within hours of disclosure.
Fixed: WordPress 6.9.5 and 7.0.2 (17 July 2026)
How do two flaws form a single chain?
WordPress’s `/wp-json/batch/v1` API bundles several REST calls into a single request. CVE-2026-63030 comes from failed sub-requests not being appended to the `$matches` array, which shifts the indexes. The attacker first sends a deliberately failing low-privilege request, then a high-privilege one that runs without an authorization check.
CVE-2026-60137 comes from `WP_Query`’s `author_exclude` parameter, sanitised only when it arrives as an integer array. The first flaw is precisely what lets a string through instead, and the SQL injection lands.
How do you get from injection to webshell?
The observed sequence is mechanical: SQL injection, privilege escalation, admin account creation, login with that account, malicious plugin upload, code execution.
Attackers then drop persistent webshells. Updating does not remove them: if your site was exposed between 17 and 20 July 2026, the fix is not enough. You have to go looking.
Why does this one hit everybody?
This is not a third-party plugin, it is WordPress core, on a default install. Versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are all affected.
In-the-wild exploitation was confirmed by several security vendors from 18 July 2026, the day after disclosure. The delay between a published fix and an industrialised attack is now measured in hours.
What should you do today?
Move to 6.9.5 or 7.0.2 now. Then look for traces: admin accounts you do not recognise, plugins you did not install, recent PHP files under `wp-content/uploads` and `wp-content/plugins`.
Almost no brochure site uses the batch REST API. Filtering it upstream costs nothing and removes the first step of the chain.
Who is affected?
- WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1: default install
- Fixed in WordPress 6.9.5 and 7.0.2, released 17 July 2026
- CVE-2026-63030: CVSS 9.8 · CVE-2026-60137: CVSS 5.9
- In-the-wild exploitation confirmed from 18 July 2026
How does AtriShield stop it?
Virtual patch (Business and Enterprise): the flaw is neutralised at the entrance of your server, without changing your application and without waiting for a maintenance window. Security metadata is reported to your console.
- ✓Virtual patch on `/wp-json/batch/v1`: request batches crafted to shift the authorization index are rejected at the edge.
- ✓SQL injection payloads aimed at `author_exclude` are blocked before they reach WordPress.
- ✓Malicious plugin upload, the last step of the chain, is cut even if an earlier step gets through.
- ✓No change to WordPress core: the protection holds while you plan and test the upgrade.
Sources
- Rapid7 - CVE-2026-63030 (wp2shell), critical RCE in WordPress Core
- Wiz - Exploitation in the wild of wp2shell
- Tenable - wp2shell: WordPress Core pre-auth RCE FAQ
Analysis published by Atrilya Solutions, based on public security reporting. The links above point to the original sources.