Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2026-63030 | 7.5 | 97.3% | ✅ listed | — | 75.25 (High) |
| CVE-2026-60137 | 9.1 | 78.3% | ✅ listed | — | 89.3 (Critical) |
wp2shell: Unauthenticated RCE via WordPress REST API
Fidelis Security has disclosed wp2shell, a two-vulnerability attack chain that lets unauthenticated attackers achieve remote code execution against WordPress Core via the REST API batch endpoint. The chain combines CVE-2026-63030 (REST API batch route confusion, CVSS 7.5, EPSS 97.3%, CISA KEV) with CVE-2026-60137 (WP_Query author__not_in SQL injection, CVSS 9.1, EPSS 78.3%, CISA KEV).
The first flaw, CVE-2026-63030, is a route confusion in the REST API batch endpoint that lets an attacker bypass authentication and reach internal handlers without the required permission checks. The second, CVE-2026-60137, is a SQL injection in the author__not_in parameter of WP_Query that fires when a plugin or theme passes untrusted input to the parameter. Chained together, the two give a full pre-auth RCE: the attacker sends a crafted batch request, triggers the SQL injection, and drops a PHP web shell.
How the two flaws chain into RCE
The chain executes in five steps. First, the attacker sends a crafted batch request to the REST API batch endpoint. This is where CVE-2026-63030 lives: the route confusion lets the request bypass authentication and reach internal handlers that normally require permission checks. The attacker does not need a valid session or nonce at this stage.
Second, the request lands in the internal WP_Query handler. Because the batch endpoint routed it past the standard permission gate, the handler runs without the usual capability or role check that would normally reject an unauthenticated caller.
Third, the handler reaches the vulnerable author__not_in parameter. This is CVE-2026-60137. The parameter is passed to WP_Query without proper sanitization, so the attacker-controlled value flows directly into the SQL query.
Fourth, the attacker supplies a crafted input to author__not_in that alters the database query. The SQL injection fires, giving the attacker control over the query execution. This is the step that turns the two separate flaws into a working RCE.
Fifth, the attacker chains both vulnerabilities into a single unauthenticated RCE. The batch request triggers the SQL injection, which drops a PHP web shell. No plugin, theme, or user interaction is required — the entire chain runs through the REST API batch endpoint against WordPress Core.
Who is affected
WordPress 6.8.x through 6.8.5, 6.9.x through 6.9.4, and 7.0.x through 7.0.1 are affected by CVE-2026-60137. The flaw sits in the author__not_in parameter of WP_Query, which fails to sanitize untrusted input before it reaches the SQL query. A plugin or theme that passes attacker-controlled data to the parameter triggers the injection.
CVE-2026-63030 covers the same version range: 6.9.x before 6.9.5 and 7.0.x before 7.0.2. It is a route confusion in the REST API batch endpoint that lets the request bypass authentication and reach the internal handler without the standard permission check. The two CVEs chain so the batch request lands in the WP_Query handler that needs the author__not_in injection.
No plugin, theme, or user interaction is required. The entire chain runs through the REST API batch endpoint against WordPress Core, so any site with a plugin or theme that forwards untrusted input to author__not_in is exposed.
Exploitation in the wild
FortiGuard IPS blocked 4,649 exploitation attempts in the 24 hours leading up to publication, with 88,452 detections over the preceding seven days. The highest volume originated from or targeted Poland and Turkey, according to FortiGuard Labs telemetry.
watchTowr honeypots recorded tens of thousands of exploit attempts against the same chain. Jake Knott, principal security researcher at watchTowr, noted the team reproduced CVE-2026-63030 within minutes of disclosure and CVE-2026-60137 with additional effort, citing the ready availability of public proof-of-concept exploits for both CVEs as the driver behind the rapid mass exploitation.
Mitigation and WAF coverage
Administrators should patch to WordPress 6.8.6, 6.9.5, or 7.0.2 to close both CVEs. The three version lines cover the full affected range for CVE-2026-60137 and the REST API batch endpoint for CVE-2026-63030.
Cloudflare has deployed WAF rules for both vulnerabilities across all plans, including free accounts. The rules block the SQL injection in author__not_in (CVE-2026-60137) and the REST API batch-route confusion (CVE-2026-63030) for sites proxied behind the platform.
"WAF protections reduce exposure while customers update, but they are not a substitute for patching," Cloudflare said.
Key points
- CVE-2026-63030 is a REST API batch endpoint route confusion (CVSS 7.5) that lets attackers bypass permission checks to reach internal handlers.
- CVE-2026-60137 is a SQL injection in WP_Query's author__not_in parameter (CVSS 9.1) affecting WordPress 6.8.x through 7.0.x.
- The chain enables unauthenticated RCE: attacker sends a crafted batch request, triggers SQL injection, and executes code without login, plugins, or user interaction.
- Affected versions: 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2. Both CVEs are in CISA KEV.
- FortiGuard Labs reports 4,649 blocked attempts in 24 hours and 88,452 detections over seven days, with top traffic from Turkey.