WordPress wp2shell flaws get public exploits; watchTowr reports early exploitation signs
Summary
Public PoCs target two WordPress flaws that can be chained for pre-authentication RCE. watchTowr reports early signs of in-the-wild exploitation. WordPress released fixes and recommends updating to 7.0.2 or 6.9.5.
Key points
- CVE-2026-63030, a REST API batch-route confusion flaw, can be chained with CVE-2026-60137, an SQL injection flaw, for pre-authentication RCE.
- The RCE chain affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1; the SQL injection flaw also affects WordPress 6.8.0–6.8.5 but cannot be chained to RCE there.
- WordPress fixed the chain in versions 6.9.5 and 7.0.2 and enabled forced automatic security updates for supported affected installations.
- Public PoCs have been released. Some reportedly extract password hashes and then use administrator access; others claim pre-authentication RCE.
- watchTowr says it has observed the first signs of in-the-wild exploitation; the article does not independently confirm those reports.
- Temporary mitigations include blocking anonymous REST API access or blocking the affected batch endpoints at a WAF; Searchlight Cyber says these are not substitutes for patching.
- Cloudflare says it deployed WAF protections for both flaws across plans for sites proxied through its platform.
Article Details
- Vulnerability Types
- REST API batch-route confusion
- SQL injection
- Pre-authentication remote code execution
- Severity
- Critical
- Affected Versions
- WordPress 6.9.0 through 6.9.4
- WordPress 7.0.0 through 7.0.1
- WordPress 6.8.0 through 6.8.5
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Temporarily install a plugin that blocks anonymous access to the REST API.
- Temporarily block /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF level.
MITRE ATT&CK
T1078 · Valid AccountsSome public PoCs reportedly use the cracked administrator password to log in before uploading a malicious plugin and executing commands.T1110.002 · Password CrackingSome public PoCs reportedly extract WordPress password hashes and crack an administrator password.T1190 · Exploit Public-Facing ApplicationThe reported exploit chain targets vulnerable, publicly accessible WordPress installations to achieve pre-authentication remote code execution.