Listen to this Post
Introduction:
The wp2shell vulnerability chain represents the most significant unauthenticated remote code execution (RCE) vulnerability to affect WordPress Core in nearly a decade. Discovered by security researcher Adam Kues of Assetnote/Searchlight Cyber using OpenAI’s GPT-5.6 Sol—a process that took approximately 10 hours and an estimated $25 in compute costs—the chain combines two distinct CVEs: CVE-2026-63030 (CVSS 9.8), a REST API batch request route confusion vulnerability, and CVE-2026-60137 (CVSS 5.9), an unauthenticated SQL injection. When chained together, these vulnerabilities enable an attacker with no credentials to create an administrator account and execute arbitrary code on a default WordPress installation without requiring any plugins or themes. The public disclosure occurred on July 17, 2026, with patched versions 6.8.6, 6.9.5, and 7.0.2 released simultaneously. Within hours, mass exploitation campaigns began, with Wordfence reporting over 11 million exploit attempts blocked by its firewall.
Learning Objectives & Secrets:
- Objective 1: Understand the wp2shell Attack Chain Architecture — Master how CVE-2026-63030’s REST API route confusion enables unauthenticated SQL injection via CVE-2026-60137, creating a pre-authentication RCE pipeline. The secret: the attack is a single physical HTTP request to `/batch/v1` containing nested batch requests that confuse WordPress’s request routing.
-
Objective 2 Secret: Exploit the author__not_in Parameter — The SQL injection occurs because the `author__not_in` parameter is not type-checked by the widget schema, while the posts callback maps it directly to
WP_Query::author__not_in. The critical insight: WordPress sanitizes `author__not_in` only when it is already an array—a scalar string bypasses sanitization and is interpolated directly into the SQL query. -
Objective 3 Secret: Forge WP_Post Objects for Privilege Escalation — The SQL injection is SELECT-only; it doesn’t directly write to the database. Instead, it returns forged rows that WordPress converts into `WP_Post` objects and caches. Core update logic then consumes these forged objects to publish a Customizer changeset attributed to a real administrator ID, temporarily assuming that administrator’s identity.
You Should Know:
1. Vulnerability Breakdown: CVE-2026-63030 and CVE-2026-60137
The wp2shell chain exploits two distinct vulnerabilities that affect different WordPress version ranges. CVE-2026-63030, the REST API batch route confusion vulnerability with a CVSS score of 9.8, affects WordPress versions 6.9.0–6.9.4 and 7.0.0–7.0.1. This vulnerability allows an attacker to craft a malformed batch request where a request validated against one route is paired with the callback and permission handler of another route. The outer shift lets a widget-shaped request invoke the batch callback (bypassing the batch schema’s prohibition on inner GET requests), while the inner shift lets a request validated as a widget invoke the posts collection callback.
CVE-2026-60137 is an unauthenticated SQL injection vulnerability affecting WordPress versions 6.8 through 6.8.5, 6.9 through 6.9.4, and 7.0 through 7.0.1. The vulnerability resides in how WordPress handles the `author__not_in` parameter within WP_Query. When a scalar string is passed instead of an array, the sanitization branch is skipped, and the string is interpolated directly into the SQL query: AND wp_posts.post_author NOT IN (<attacker scalar>). By closing the `NOT IN` expression and using `UNION` to inject complete rows in the physical 23-column `wp_posts` order, an attacker can return arbitrary data that WordPress will treat as legitimate post objects.
2. Step-by-Step Exploitation Flow
The exploitation process unfolds in a single HTTP request but executes multiple stages internally:
Step 1: Route Confusion — The attacker sends a malformed batch request to `/batch/v1` containing nested batch operations. The outer batch uses a widget-shaped request to invoke the batch callback, bypassing schema restrictions. The inner batch then uses a request validated as a widget to invoke the posts collection callback.
Step 2: SQL Injection via author__not_in — Because the widget schema doesn’t type-check the `author__not_in` parameter, the scalar string payload reaches `WP_Query` unsanitized. The payload closes the `NOT IN` expression and uses `UNION` to return forged rows. Setting `per_page=500` prevents WordPress from splitting the result set by ID, ensuring the full forged rows are returned.
Step 3: Object Cache Poisoning — WordPress converts the forged SQL rows into `WP_Post` objects and stores them in its in-process object cache. These objects contain attacker-controlled data, including post status, post date, and post author fields.
Step 4: Customizer Changeset Forgery — Core’s hierarchy-repair code processes the forged objects. One forged post-parent cycle triggers the writing and publishing of a past-dated Customizer changeset. This changeset contains an `nav_menus_created_posts` setting attributed to a real administrator ID.
Step 5: Privilege Escalation — The Customizer code temporarily calls wp_set_current_user(admin_id), assuming the identity of the real administrator. The original REST request then re-enters processing with administrator privileges. With these privileges, the attacker can upload a malicious plugin containing a webshell and execute arbitrary PHP code.
3. Post-Exploitation Activities Observed in the Wild
Wiz Research has documented extensive post-exploitation activity following successful wp2shell exploitation. Attackers have been observed:
- Malicious Plugin Upload: Accessing `/wp-admin/plugin-install.php?tab=upload` and executing `POST /wp-admin/update.php?action=upload-plugin` to install persistent backdoors.
-
User Enumeration: Sending requests to `/wp-json/wp/v2/users?context=edit` to harvest administrator usernames and email addresses.
-
Local File Inclusion: Performing LFI attacks via `admin-ajax.php?template=../../../wp-config` targeting database credentials and authentication keys.
-
Webshell Deployment: Two primary webshell types have been identified—a minimal one-liner backdoor and a sophisticated 150KB webshell disguised as the “CMSmap” plugin containing a full-featured attack platform with file management, database access, port scanning, and privilege escalation modules.
4. Detection and Mitigation Commands
Linux (WordPress Server):
Check WordPress version
wp core version --allow-root
Manual version check via wp-includes/version.php
grep "\$wp_version" /var/www/html/wp-includes/version.php
Search for recently modified plugin files (potential backdoors)
find /var/www/html/wp-content/plugins -type f -1ame ".php" -mtime -7 -exec ls -la {} \;
Check for unauthorized admin users via WP-CLI
wp user list --role=administrator --allow-root
Search for suspicious PHP functions in plugins
grep -r "eval(" /var/www/html/wp-content/plugins/
grep -r "base64_decode" /var/www/html/wp-content/plugins/
grep -r "system(" /var/www/html/wp-content/plugins/
Windows (IIS with WordPress):
Check WordPress version via PowerShell
Get-Content C:\inetpub\wwwroot\wp-includes\version.php | Select-String "\$wp_version"
Find recently modified PHP files
Get-ChildItem -Path C:\inetpub\wwwroot\wp-content\plugins -Recurse -Filter ".php" | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)}
Search for suspicious PHP functions
Select-String -Path C:\inetpub\wwwroot\wp-content\plugins.php -Pattern "eval("
Select-String -Path C:\inetpub\wwwroot\wp-content\plugins.php -Pattern "base64_decode"
WAF Rule Configuration (ModSecurity Example):
Block wp2shell exploitation attempts SecRule ARGS "author__not_in.UNION.SELECT" \ "id:100001,phase:2,deny,status:403,msg:'wp2shell SQL Injection Attempt'" Block batch endpoint abuse SecRule REQUEST_URI "/batch/v1" \ "id:100002,phase:1,deny,status:403,msg:'wp2shell Batch API Abuse'"
5. Hardening and Patching Strategy
The most critical mitigation is immediate patching. WordPress released forced automatic updates for affected versions, but site administrators should verify completion. The patched versions are:
– WordPress 6.8.6 (addresses CVE-2026-60137)
– WordPress 6.9.5 (addresses both CVEs)
– WordPress 7.0.2 (addresses both CVEs)
For sites unable to patch immediately, implement the following defenses:
NGINX Rate Limiting for Batch API:
location /batch/v1 {
limit_req zone=wp2shell_limit burst=5 nodelay;
limit_req_status 429;
return 403;
}
Apache .htaccess Block:
<LocationMatch "/batch/v1"> Require all denied </LocationMatch>
Wordfence Firewall provided protection to Premium customers on the day of disclosure (July 17, 2026), with Free users receiving protection 30 days later on August 16, 2026. However, firewall protection is not a replacement for patching.
6. Cloud Environment Risk Assessment
Wiz Research data indicates that at the time of disclosure, 60% of organizations using WordPress had at least one vulnerable instance, and 25% were exposing a vulnerable server to the internet. Within 24 hours of publication, these figures dropped to 50% and 10% respectively as organizations applied patches. Attackers have been observed conducting high-volume scanning campaigns without subsequent post-exploitation, suggesting opportunistic mass-scanning campaigns seeking to identify vulnerable targets.
What Undercode Say:
- Key Takeaway 1: The wp2shell chain demonstrates that AI-assisted vulnerability discovery is now a reality—GPT-5.6 Sol discovered a $500,000 vulnerability in approximately 10 hours. The window between disclosure and exploitation has collapsed from days to hours, with PoC exploits appearing within minutes of patch release.
-
Key Takeaway 2: The most dangerous aspect of wp2shell is that it targets WordPress Core itself—no plugins, no themes, no user interaction required. Any default WordPress installation exposed to the internet is vulnerable. This represents a paradigm shift in WordPress security: the core is no longer implicitly trusted.
-
Analysis: The competition achievement described in the source post—specifically, the first-blood solve of a wp2shell challenge—highlights the real-world applicability of this vulnerability. The fact that a cybersecurity competition included this recently disclosed CVE (released July 2026) demonstrates how quickly emerging threats are being integrated into practical security training. The team’s success in manually analyzing and scripting the exploit without AI assistance underscores the continued importance of fundamental security skills even as AI tools transform the discovery landscape. The 2nd place finish in the Network Engineering Competition 2026 validates that hands-on CTF experience with real CVEs provides tangible competitive advantage. For security practitioners, this serves as a reminder: staying current with emerging vulnerabilities—especially those affecting widely deployed platforms like WordPress—is not optional but essential.
Prediction:
-
+1 The forced automatic update mechanism deployed by WordPress for this vulnerability will set a precedent for faster, more aggressive patching of critical core vulnerabilities in the future, reducing the average window of exposure for millions of sites.
-
+1 AI-assisted vulnerability discovery will become standard practice, potentially increasing the rate of critical vulnerability identification and reducing the cost of discovery, which could lead to more secure software overall.
-
-1 The collapse of the disclosure-to-exploitation window to mere hours means organizations without automated patch management or WAF protection will face increasing risk of compromise before they can respond.
-
-1 The sophistication of post-exploitation payloads—including 150KB webshells with graphical interfaces and privilege escalation modules—indicates that attackers are investing significant resources in weaponizing new vulnerabilities, making detection and remediation more challenging.
-
-1 With over 400 million sites running affected versions at disclosure, and mass scanning campaigns actively identifying vulnerable targets, residual unpatched instances will continue to be compromised for months, potentially leading to widespread website defacement, data theft, and SEO poisoning campaigns.
▶️ Related Video (74% Match):
https://www.youtube.com/watch?v=4Fj1V2tkJYg
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/eBprYNjQ – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
