[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUfSVU0iqektx1QY-QC8MewJRUtQMYmoY4Qnn-L3etHs":3,"$fp8CHZnQD60yGSZUu--hg5gbDSV2Qnv5S3TIXtaIOFa0":66},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":63,"created_at":64,"updated_at":65,"published_at":42},"fidelis-security-discloses-wp2shell-attack-chain-for-unauthenticated-wordpress-r","Fidelis Security Discloses wp2shell Attack Chain for Unauthenticated WordPress RCE","CVE-2026-63030 and CVE-2026-60137 chain REST API route confusion with WP_Query SQL injection to achieve pre-auth RCE on WordPress 6.8–7.0.","Fidelis Security has disclosed the wp2shell attack chain, a two-CVE exploit that lets unauthenticated attackers achieve remote code execution on WordPress Core via the REST API batch endpoint and a WP_Query SQL injection in the author__not_in parameter.",[10,11,12,13,14,15],"WordPress","wp2shell","CVE-2026-60137","CVE-2026-63030","REST API","SQL Injection","# Fidelis Security Discloses wp2shell Attack Chain for Unauthenticated WordPress RCE\n\n*CVE-2026-63030 and CVE-2026-60137 chain REST API route confusion with WP_Query SQL injection to achieve pre-auth RCE on WordPress 6.8–7.0.*\n\n**Tags:** `WordPress` `wp2shell` `CVE-2026-60137` `CVE-2026-63030` `REST API` `SQL Injection`\n\n> Fidelis Security has disclosed the wp2shell attack chain, a two-CVE exploit that lets unauthenticated attackers achieve remote code execution on WordPress Core via the REST API batch endpoint and a WP_Query SQL injection in the author__not_in parameter.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2026-63030 | 7.5 | 97.3% | ✅ listed | — | 75.25 (High) |\n| CVE-2026-60137 | 9.1 | 78.3% | ✅ listed | — | 89.3 (Critical) |\n\n## wp2shell: Unauthenticated RCE via WordPress REST API\n\nFidelis Security has disclosed **wp2shell**, a two-vulnerability attack chain that lets unauthenticated attackers achieve remote code execution against WordPress Core via the REST API batch endpoint. The chain combines **CVE-2026-63030** (REST API batch route confusion, CVSS 7.5, EPSS 97.3%, CISA KEV) with **CVE-2026-60137** (WP_Query `author__not_in` SQL injection, CVSS 9.1, EPSS 78.3%, CISA KEV).\n\nThe first flaw, CVE-2026-63030, is a route confusion in the REST API batch endpoint that lets an attacker bypass authentication and reach internal handlers without the required permission checks. The second, CVE-2026-60137, is a SQL injection in the `author__not_in` parameter of `WP_Query` that fires when a plugin or theme passes untrusted input to the parameter. Chained together, the two give a full pre-auth RCE: the attacker sends a crafted batch request, triggers the SQL injection, and drops a PHP web shell.\n\n## How the two flaws chain into RCE\n\nThe chain executes in five steps. First, the attacker sends a crafted batch request to the REST API batch endpoint. This is where CVE-2026-63030 lives: the route confusion lets the request bypass authentication and reach internal handlers that normally require permission checks. The attacker does not need a valid session or nonce at this stage.\n\nSecond, the request lands in the internal `WP_Query` handler. Because the batch endpoint routed it past the standard permission gate, the handler runs without the usual capability or role check that would normally reject an unauthenticated caller.\n\nThird, the handler reaches the vulnerable `author__not_in` parameter. This is CVE-2026-60137. The parameter is passed to `WP_Query` without proper sanitization, so the attacker-controlled value flows directly into the SQL query.\n\nFourth, the attacker supplies a crafted input to `author__not_in` that alters the database query. The SQL injection fires, giving the attacker control over the query execution. This is the step that turns the two separate flaws into a working RCE.\n\nFifth, the attacker chains both vulnerabilities into a single unauthenticated RCE. The batch request triggers the SQL injection, which drops a PHP web shell. No plugin, theme, or user interaction is required — the entire chain runs through the REST API batch endpoint against WordPress Core.\n\n## Who is affected\n\nWordPress 6.8.x through 6.8.5, 6.9.x through 6.9.4, and 7.0.x through 7.0.1 are affected by CVE-2026-60137. The flaw sits in the `author__not_in` parameter of `WP_Query`, which fails to sanitize untrusted input before it reaches the SQL query. A plugin or theme that passes attacker-controlled data to the parameter triggers the injection.\n\nCVE-2026-63030 covers the same version range: 6.9.x before 6.9.5 and 7.0.x before 7.0.2. It is a route confusion in the REST API batch endpoint that lets the request bypass authentication and reach the internal handler without the standard permission check. The two CVEs chain so the batch request lands in the `WP_Query` handler that needs the `author__not_in` injection.\n\nNo plugin, theme, or user interaction is required. The entire chain runs through the REST API batch endpoint against WordPress Core, so any site with a plugin or theme that forwards untrusted input to `author__not_in` is exposed.\n\n## Exploitation in the wild\n\nFortiGuard IPS blocked 4,649 exploitation attempts in the 24 hours leading up to publication, with 88,452 detections over the preceding seven days. The highest volume originated from or targeted Poland and Turkey, according to FortiGuard Labs telemetry.\n\nwatchTowr honeypots recorded tens of thousands of exploit attempts against the same chain. Jake Knott, principal security researcher at watchTowr, noted the team reproduced CVE-2026-63030 within minutes of disclosure and CVE-2026-60137 with additional effort, citing the ready availability of public proof-of-concept exploits for both CVEs as the driver behind the rapid mass exploitation.\n\n## Mitigation and WAF coverage\n\nAdministrators should patch to WordPress 6.8.6, 6.9.5, or 7.0.2 to close both CVEs. The three version lines cover the full affected range for CVE-2026-60137 and the REST API batch endpoint for CVE-2026-63030.\n\nCloudflare has deployed WAF rules for both vulnerabilities across all plans, including free accounts. The rules block the SQL injection in `author__not_in` (CVE-2026-60137) and the REST API batch-route confusion (CVE-2026-63030) for sites proxied behind the platform.\n\n\"WAF protections reduce exposure while customers update, but they are not a substitute for patching,\" Cloudflare said.\n\n## Key points\n\n- CVE-2026-63030 is a REST API batch endpoint route confusion (CVSS 7.5) that lets attackers bypass permission checks to reach internal handlers.\n- CVE-2026-60137 is a SQL injection in WP_Query's author__not_in parameter (CVSS 9.1) affecting WordPress 6.8.x through 7.0.x.\n- The chain enables unauthenticated RCE: attacker sends a crafted batch request, triggers SQL injection, and executes code without login, plugins, or user interaction.\n- Affected versions: 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2. Both CVEs are in CISA KEV.\n- FortiGuard Labs reports 4,649 blocked attempts in 24 hours and 88,452 detections over seven days, with top traffic from Turkey.\n\n## Further reading & sources\n\n- [WordPress REST API Security: wp2shell Attack Chain](https:\u002F\u002Ffidelissecurity.com\u002Fthreatgeek\u002Fthreat-detection-response\u002Fwordpress-rest-api-security-wp2shell-attack-chain) — Fidelis Security\n- [WP2Shell RCE | Outbreak Alert | FortiGuard Labs](https:\u002F\u002Ffortiguard.fortinet.com\u002Foutbreak-alert\u002Fwp2shell-rce)\n- [WordPress Core \"wp2shell\" RCE flaws get public exploits, patch now](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fwordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now\u002F)\n- ['WP2Shell' Opens Millions of WordPress Sites to Remote Takeover](https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fwp2shell-millions-wordpress-sites-remote-takeover)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffidelis-security-discloses-wp2shell-attack-chain-for-unauthenticated-wordpress-r.png?v=b1c1aa3d09",{"cves":19,"malware":35,"targets":38,"timeline":43,"technologies":59},[20,29],{"id":12,"kev":21,"poc":22,"url":23,"cvss":24,"epss":25,"risk_band":26,"risk_score":27,"cvss_version":28},true,false,"\u002Fvulnerabilities\u002FCVE-2026-60137",5.9,0.0532,"High",74.19,"3.1",{"id":13,"kev":21,"poc":22,"url":30,"cvss":31,"epss":32,"risk_band":33,"risk_score":34,"cvss_version":28},"\u002Fvulnerabilities\u002FCVE-2026-63030",9.8,0.1065,"Critical",89.69,[36],{"name":37},"PHP web shell",[39],{"name":10,"sector":40,"status":41,"geography":42},"CMS","confirmed",null,[44,48,51,55],{"date":45,"event":46,"description":47},"2026-07-17","Disclosure","WordPress issued security update",{"date":45,"event":49,"description":50},"Patch release","WordPress releases emergency security updates (6.8.6, 6.9.5, and 7.0.2) addressing the vulnerabilities that form the WP2Shell exploit chain.",{"date":52,"event":53,"description":54},"2026-07-18","Public exploit release","Public exploits released for the wp2shell RCE vulnerabilities.",{"date":56,"event":57,"description":58},"2026-07-21","Kev addition","ISA adds CVE-2026-63030 to the Known Exploited Vulnerabilities (KEV) Catalog, requiring U.S. federal agencies to remediate affected systems on an accelerated timeline.",[60,61],{"vendor":10,"product":10},{"vendor":10,"product":62},"WordPress Core","vulnerability_disclosure","2026-09-22T07:08:43.775939+00:00","2026-10-16T12:28:16.112446+00:00",{"articles":67},[68,81,94,106],{"slug":69,"title":70,"summary":71,"tags":72,"hero_image_url":79,"story_type":63,"created_at":80},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","Red Hat disclosed a critical vulnerability in Keycloak's reset-credentials flow that allows a remote unauthenticated attacker to bypass the email verification step and reset the password for any user account in any realm.",[73,74,75,76,77,78],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a","2026-09-30T12:09:12.456253+00:00",{"slug":82,"title":83,"summary":84,"tags":85,"hero_image_url":92,"story_type":63,"created_at":93},"trend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-","Trend Micro ZDI: Windows Shell Link zero-day exploited by 11 state-backed groups since 2017","Trend Micro's Zero-Day Initiative disclosed a new Windows Shell Link (.lnk) zero-day (ZDI-CAN-25373) exploited in the wild by 11 state-backed groups since 2017, which Microsoft declined to patch as 'not meeting the bar servicing'.",[86,87,88,89,90,91],"windows","shell-link","zero-day","ZDI","Trend Micro","state-sponsored","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-.png?v=a2818b0e7b","2026-09-30T12:04:13.324344+00:00",{"slug":95,"title":96,"summary":97,"tags":98,"hero_image_url":104,"story_type":63,"created_at":105},"head-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog","Head Mare Exploits Three Zero-Days to Trojanize TrueConf, Atlassian Rovo, and Progress LoadMaster","The Head Mare APT group is actively exploiting three zero-day vulnerabilities in Atlassian Rovo, Progress LoadMaster, and Metabase, with Progress LoadMaster CVE-2026-8037 now on CISA KEV after 792 observed exploitation attempts.",[99,88,100,101,102,103],"Head Mare","Atlassian Rovo","Progress LoadMaster","Metabase","CVE-2026-8037","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog.png?v=48acc20ab2","2026-09-22T12:04:22.141581+00:00",{"slug":107,"title":108,"summary":109,"tags":110,"hero_image_url":116,"story_type":63,"created_at":117},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-Able N-Central RCE with 3-day federal deadline","CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog for N-able N-central, an unauthenticated authentication bypass that grants remote administrative access on versions through 2026.1, with a 3-day federal deadline and active in-the-wild exploitation.",[111,112,113,114,115],"CVE-2026-18556","N-Able N-Central","CISA KEV","RCE","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","2026-09-21T12:03:34.769619+00:00"]