wp2shell WordPress Flaw Enables Unauthenticated Remote Code Execution

A pair of chained vulnerabilities in WordPress core—collectively dubbed wp2shell—allows an anonymous attacker to execute arbitrary code on affected sites without authentication or plugins. Security researcher Adam Kues at Assetnote, the attack-surface-management arm of Searchlight Cyber, discovered the batch-route confusion bug through WordPress's HackerOne program, while TF1T, dtro, and haongo separately reported the underlying SQL injection. The full technical mechanism is now public, a working proof-of-concept exploit has been published on GitHub, and the flaws have been assigned CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection in WordPress core).

The chain works in two stages. The SQL injection lives in WP_Query's author__not_in parameter, where supplying a string instead of an array bypasses the type check and feeds the raw value directly into the query. The batch endpoint at /wp-json/batch/v1 is what exposes that parameter to unauthenticated callers: WordPress tracks sub-requests in two parallel arrays, and an error in one sub-request desynchronizes them by one position, causing a subsequent request to execute under a different user's identity. Version ranges split accordingly—6.8.x is vulnerable only to the SQL injection (fixed in 6.8.6), while 6.9.0–6.9.4 and 7.0.0–7.0.1 are vulnerable to the full unauthenticated RCE chain, patched in 6.9.5 and 7.0.2 respectively, with 7.1 beta2 carrying both fixes.

WordPress shipped the patches on Friday alongside what it calls forced auto-updates, but has not clarified whether the forced push reaches administrators who disabled auto-updates. Operators should verify their deployed version rather than assume the patch landed. With the RCE path only existing from WordPress 6.9 (released December 2, 2025), every exploitable site is running a release less than eight months old—administrators can confirm exposure with a privacy checkup and validate their hosting configuration using the SSL/TLS checker to rule out additional attack surface, while defenders can probe internet-exposed instances with the port scanner.

Searchlight Cyber estimates the broader WordPress install base at over 500 million sites, though the exposed set is a smaller subset limited to 6.9 and 7.0 deployments. With a public PoC now circulating, the window for opportunistic mass exploitation is open. Site owners running vulnerable versions should upgrade immediately, audit logs for anomalous requests to /wp-json/batch/v1, and rotate any credentials stored in wp-config.php or the database—starting with database passwords—since a successful exploit would grant the attacker full filesystem and database access.