WP2Shell: Pre-Auth WordPress Core RCE Chains SQL Injection to Admin Takeover

The WP2Shell exploit chain requires two CVEs to achieve remote code execution. Neither vulnerability produces RCE alone; the combination produces a complete, unauthenticated attack path.

CVE-2026-63030: REST API batch handler desynchronization. The WordPress REST API batch endpoint at /wp-json/batch/v1 processes multiple sub-requests in a single HTTP call. Internally, it runs two separate loops: one for validation and one for execution. When the validation loop encounters a sub-request path prefixed with three forward slashes (///), the call to wp_parse_url() fails. The failure pushes an error entry to the validation result array but nothing to the matches array, causing the two arrays to fall out of sync by one index position. The execution loop then dispatches all subsequent sub-requests under the handler matched for the previous path — a handler that has already passed validation but targets a different endpoint, bypassing that endpoint's method-level authentication checks.

CVE-2026-60137: SQL injection via WP_Query author__not_in. Once the batch desynchronization reaches a sub-request that queries posts via WP_Query, the author__not_in (or author_exclude) parameter is not properly sanitized. An attacker injects a UNION-based SQL payload: the query terminates the expected integer comparison early with a closing parenthesis, then appends a UNION SELECT that extracts arbitrary data from the WordPress database, including the wp_users table containing user credentials, emails, and password hashes.

Post-exploitation path. After extracting database contents, attackers create new administrator accounts using the extracted session tokens or by injecting directly into wp_users. The rogue admin account (observed usernames use the prefix w2s_ followed by a hex string) then authenticates to the WordPress admin panel, uploads a PHP plugin containing a webshell, and installs it. The webshell provides persistent command execution at the web server's process privilege level. This pattern is consistent with what Decryption Digest documented in the software supply chain attack defense guide, where a single untrusted input point cascades to full pipeline compromise.

WordPress powers approximately 43% of all websites globally — a deployment footprint that makes CVE-2026-63030 one of the most broadly applicable pre-auth RCE vulnerabilities disclosed in 2026. The affected version range (6.9.0–6.9.4 and 7.0.0–7.0.1) corresponds to releases shipped between January and July 2026, meaning the vulnerability affects installations that kept up with WordPress major updates but had not yet applied the July 17 security patch.

Self-hosted WordPress sites are the highest-risk category. Organizations running WordPress on their own servers, cloud VMs, or container infrastructure that disabled auto-updates — a common practice in production environments where update testing is required before deployment — remain fully vulnerable. Managed WordPress hosting platforms with delayed update pipelines are a second risk tier. Multisite WordPress networks compound the impact: a single compromised network-level installation affects all subsites under that installation.

The attack requires only that the target's WordPress REST API is accessible from the internet, which is the default configuration. Blocking the REST API entirely breaks plugin functionality for a significant share of WordPress deployments, so most sites leave it enabled. The specific batch endpoint at /wp-json/batch/v1 introduced in WordPress 6.9 is the sole entry point for CVE-2026-63030; sites running WordPress 6.8.x and earlier are not vulnerable to this specific chain.

Active exploitation continues more than 30 days after disclosure. F5 Labs observed exploitation attempts from nine distinct IP addresses across Singapore, Germany, France, and the United States. Bitdefender MDR documented attacker infrastructure with multiple attempts before achieving successful RCE, indicating iterative exploitation campaigns rather than one-off opportunistic scanning. Check your REST API authentication controls and secret scanning in your WordPress deployment as part of your post-incident review if WP2Shell exposure cannot be ruled out.

F5 Labs and Bitdefender MDR captured attacker infrastructure and webshell artifacts from active WP2Shell exploitation campaigns. These IOCs represent confirmed attacker tooling — block the IPs at your perimeter firewall and run the SHA-256 hashes against any WordPress wp-content directory you manage, including backups from the past 30 days.

The malicious plugin droppers are the primary persistence mechanism. They install a PHP plugin that registers shell execution capabilities accessible via a specific URL parameter. The webshell hashes represent standalone PHP files placed directly in wp-content/uploads/ or randomized subdirectories. Any match on these hashes in your environment should trigger an immediate incident response, as successful installation means the attacker achieved the full post-exploitation phase.

No CVE-specific Sigma rule exists yet for CVE-2026-63030 or CVE-2026-60137 — both CVEs were disclosed in July 2026 and the SigmaHQ community rule for this specific exploit chain has not yet been merged into the stable ruleset. Behavioral detection based on process telemetry (web server spawning unexpected child processes) applies after successful exploitation, not to the initial exploit attempt. WAF rules are the primary preventive control for WP2Shell because the exploit is entirely HTTP-based and the endpoint pattern and payload structure are highly distinctive.

Deploy these rules in detection (count/log) mode first to validate they do not generate false positives in your environment before switching to block mode. The batch endpoint at /wp-json/batch/v1 serves legitimate use cases in some WordPress plugin ecosystems, so review your access logs before enabling hard block mode. Note that the ModSecurity rule is subscriber-gated on the public blog — full rule YAML is available to subscribers; the WAF configuration panel in the Decryption Digest platform shows all four platform variants with per-organization vendor dropdown selection.

Apply the WordPress security update immediately. If updating is not possible before the weekend, deploy the WAF block as an emergency control. Both steps together provide the strongest protection; the WAF rule alone does not prevent exploitation if the batch endpoint is accessible through an alternative reverse proxy path.

The WP2Shell pre-auth RCE matters because WordPress is not a niche platform — it powers 43% of all websites globally, including e-commerce stores, hospital patient portals, government information sites, financial services landing pages, and internal corporate intranets. A single exploited WordPress site can give an attacker access to customer PII, payment processing integrations, internal network segments reached via the hosting environment, and outbound email infrastructure for spam and phishing campaigns.

The attack is low-effort for attackers. Public PoC tools have been available since July 22, 2026 — the day after CISA added both CVEs to its KEV catalog. F5 Labs' capture of the live exploit payload shows that attackers refined the attack to a 735-byte POST body. Automated scanning tools can test the /wp-json/batch/v1 endpoint across the entire IPv4 address space within hours.

The timing also matters. WP2Shell was disclosed a month ago. Organizations that applied auto-updates or patched promptly are protected. The sites still running 6.9.0–6.9.4 or 7.0.0–7.0.1 on August 21, 2026 are the ones that actively manage their update schedules — which typically means larger organizations with more data, more integrations, and more valuable credentials stored in the WordPress database.

If your organization runs WordPress in any capacity — self-hosted, on managed cloud, as part of a multisite network, or via a WooCommerce store — verify your version today. A one-minute check in Dashboard > About WordPress can confirm whether this gap is already closed. If it is not, you have a specific, confirmed, high-severity attack path to close before the weekend.