A dangerous security flaw known as 'wp2shell' is actively targeting WordPress websites. By combining a REST API weakness with SQL injection, cybercriminals can hijack vulnerable servers without needing a password. If you run WordPress, you must take immediate action to safeguard your site and protect your data today.
Who Should Read This
- This advisory is intended for: WordPress site administrators, DevOps engineers, and security teams managing self-hosted WordPress instances.
Cybersecurity threats evolve rapidly, and WordPress sites are currently facing a major threat. Security researchers recently uncovered two critical core vulnerabilities that attackers are actively abusing across the web. Together, these flaws form a destructive attack chain known as wp2shell.
Understanding the components of this threat is the first step toward securing your environment.
| Vulnerability ID | Threat Type | Impacted Versions | Threat Mechanism | Recommended Action |
|---|---|---|---|---|
| CVE-2026-63030 | Remote Code Execution (wp2shell) | WordPress 6.9.0 - 6.9.4 & 7.0.0 - 7.0.1 | Desynchronizes REST API batch requests to bypass input sanitization. | Update to 6.8.6, 6.9.5, or 7.0.2 |
| CVE-2026-60137 | SQL Injection (GHSA-fpp7-x2x2-2mjf) | WordPress 6.8.x, 6.9.x, & 7.0.x | Fails to sanitize query parameters, exposing database contents. | Update to 6.8.6, 6.9.5, or 7.0.2 |
How the wp2shell Exploit Chain Works
Attackers do not need an account or valid password to launch this attack. Instead, automated scripts scan the internet for unpatched WordPress instances.
First, the attacker uses CVE-2026-63030 to confuse the WordPress REST API batch endpoint. This step bypasses standard safety checks and parameter sanitization rules.
Next, the attacker triggers CVE-2026-60137. This vulnerability sends malicious commands straight into your database query layer. Because security checks were bypassed in step one, the database executes the command without hesitation.
Finally, attackers extract administrator credentials or create a rogue user account. They quickly upload malicious scripts to gain full, server-level remote code execution.
How to Check for Compromise
If you suspect unauthorized activity, check your server logs for /wp-json/batch/v1 traffic patterns. Look for database anomalies such as unexpected user creation or admin accounts with suspicious prefixes like w2s_.
Recommendations
Update WordPress Core Immediately
Upgrade your sites to WordPress versions 6.8.6, 6.9.5, or 7.0.2. These official patches permanently eliminate the vulnerability chain.
Audit Administrator Accounts
Check your user list for unauthorized accounts, especially those with unusual prefixes (such as w2s_) or created recently.
Inspect Website Files
Search your wp-content directory for unknown plugins, rogue PHP scripts, or unexpected file changes.
Deploy a Web Application Firewall (WAF)
Use edge protection rules to block anonymous requests targeting /wp-json/batch/v1 endpoints until patching finishes.
Enforce Automated Backups
Store clean off-site backups so you can recover quickly if an incident occurs.
Long-term hardening
Disable XML-RPC if unused and use a hardened security plugin to provide holistic protection against similar exploits.