WordPress wp2shell Vulnerabilities May Enable Unauthenticated RCE; Updates Available
Summary
CERT-AGID says WordPress flaws CVE-2026-60137 and CVE-2026-63030 can be chained to enable unauthenticated access and potentially remote code execution. Fixed releases are 6.8.6, 6.9.5 and 7.0.2.
Key points
- CVE-2026-60137 is a WordPress core SQL injection; CVE-2026-63030 affects handling of REST API batch requests.
- The wp2shell chain may allow unauthenticated access to restricted functions and potentially lead to remote code execution.
- The full chain affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1; versions 6.8.0–6.8.5 are affected by the SQL injection only.
- Fixed versions are WordPress 6.8.6, 6.9.5 and 7.0.2.
- CERT-AGID recommends updating and checking for unusual batch-endpoint requests, new administrator accounts, unexpected files or plugins, web shells, and anomalous database activity.
- If suspicious signs are found, the article recommends isolating the system, preserving evidence, and checking credentials and secrets; blocking anonymous batch-endpoint access is presented only as a temporary mitigation.
Article Details
- Vulnerability Types
- SQL injection
- Improper handling of WordPress REST API batch requests
- Affected Versions
- WordPress 6.9.0 through 6.9.4
- WordPress 7.0.0 through 7.0.1
- WordPress 6.8.0 through 6.8.5 (SQL injection only)
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Temporarily block anonymous access to the REST API batch endpoints (/wp-json/batch/v1 and ?rest_route=/batch/v1) via WAF or web server configuration.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationThe article says the vulnerabilities can be chained to compromise a WordPress site through its exposed functionality, allowing unauthenticated access to restricted functions and exploitation of the core SQL injection.T1505.003 · Web ShellThe article identifies installation of web shells as a possible outcome of exploiting the vulnerability chain.
CVE
CVE-2026-60137Two WordPress core vulnerabilities, CVE-2026-60137 and CVE-2026-63030, can be chained into wp2shell to enable unauthenticated access, SQL injection, and potentially remote code execution on affected sites.CVE-2026-63030Two WordPress core vulnerabilities, CVE-2026-60137 and CVE-2026-63030, can be chained into wp2shell to enable unauthenticated access, SQL injection, and potentially remote code execution on affected sites.