A single anonymous HTTP request can lead to code execution on a WordPress site, even if the owner has installed no plugins whatsoever. The vulnerability resides in the system’s core and is composed of two separate flaws: a SQL injection and a fault in the batch processing of REST API requests. Together, they allow an attacker to travel from an ordinary visit to the site all the way to running commands on the server, without an account and without any action on the user’s part.
The wp2shell Chain and Affected Versions
The chain has been named wp2shell. Its flaws received the identifiers CVE-2026-60137 and CVE-2026-63030. The first affects WordPress from version 6.8 onward, whereas the second appeared only in the 6.9 branch. Consequently, remote code execution is possible in WordPress 6.9.0 & 6.9.4 and 7.0.0 & 7.0.1. The fixes landed in versions 6.9.5 and 7.0.2. For the 6.8 branch, version 6.8.6 was released, closing only the SQL injection. Both patches are also included in WordPress 7.1 beta 2.
WordPress developers rated the remote code execution chain as critical and enabled forced distribution of the updates through the built-in automatic installation system. Administrators are nonetheless advised to verify the actual version of each site, since successfully receiving the update depends on the server configuration and the state of the auto-update mechanism.
Part One: The SQL Injection in WP_Query
The first part of the attack lies in the WP_Query class, which WordPress uses to construct database queries. The vulnerable element proved to be the author__not_in parameter. Under normal circumstances, it should receive an array of author identifiers whose posts must be excluded from the results.
The input validation assumed that an array is always passed to the parameter. If a string is sent instead, part of the filtering can be bypassed. The unprocessed value reaches the SQL query and allows its structure to be altered. Thus arises the SQL injection registered as CVE-2026-60137.
Why the Injection Alone Was Not Enough
By itself, the flaw does not mean that any anonymous visitor automatically gains the ability to execute code. Exploitation requires passing a crafted value into the vulnerable WP_Query parameter. On WordPress 6.8 sites, such a path might appear through a theme or plugin that accepts untrusted data and uses it when forming a query. The official description therefore calls the vulnerability a “lightweight” SQL injection.
Part Two: The REST API Batch Route Confusion
WordPress 6.9 introduced the second flaw, which removed that limitation. It concerns the batch route of the REST API, /wp-json/batch/v1. This route lets several internal requests be combined into a single HTTP call, so that a client can perform multiple operations at once.
WordPress stores information about batch subrequests in parallel structures. Because of an error in handling a failed element, the records could shift relative to one another. As a result, one subrequest was executed by a handler intended for another.
A nested sequence of such requests made it possible to bypass the batch route’s restrictions and pass a crafted value into the vulnerable author__not_in. It was precisely the combination of route confusion with SQL injection that transformed two comparatively minor flaws into unauthenticated code execution.
A Core Flaw That Threatens Default Installations
The defect affects WordPress core, so the attack requires no third-party extensions or specially configured theme. Even a standard installation with default settings was at risk. The official advisory confirms that the chain affects WordPress 6.9 and 7.0 and enables remote code execution through the REST API batch route.
The ranges of vulnerable versions differ. WordPress 6.8.0 & 6.8.5 contains the SQL injection but not the batch-routing flaw, so the described RCE chain does not work for that branch. WordPress 6.9.0 & 6.9.4 and 7.0.0 & 7.0.1 contain both problems and permit the full attack.
The Object Cache Caveat
An additional condition concerns the persistent object cache. According to Cloudflare, the path to code execution works when a site does not use such a cache. By default, WordPress does not enable a persistent object cache, so this limitation does not protect most basic configurations.
Redis or Memcached can be used to store WordPress objects between individual requests. The presence of such a cache can disrupt the specific sequence of actions required for wp2shell. However, this characteristic cannot be regarded as a fix: it does not close the SQL injection and does not guarantee protection against other exploitation variants.
Reading the CVSS Scores
The severity ratings of the two CVEs may seem contradictory. WordPress calls the resulting chain critical, yet CVE-2026-63030 received a score of 7.5 out of ten. The SQL injection CVE-2026-60137 is rated higher, although on its own it does not give an anonymous visitor the same direct path to code execution. The discrepancy arises because the CVSS system considers each flaw separately, rather than the whole outcome of their combined use.
For protection, both identifiers must be tracked. Fixing only one part dismantles the attack vector but leaves the second problem in the system. WordPress 6.9.5 and 7.0.2 close both flaws, while version 6.8.6 addresses the SQL injection in the earlier branch.
Exploitation Status and Mitigations
At the time of initial disclosure, specialists reported no confirmed attacks in real systems. The absence of such information does not reduce the risk, since the patch and the change description are already publicly available. After a fix is released, researchers can compare the old and new code, reconstruct the exploitation principle, and build a working tool for finding vulnerable sites.
Cloudflare prepared firewall rules for both vulnerabilities in advance and enabled them on July 17. The protection extends to sites whose traffic passes through the Cloudflare WAF, including the free rule set. The company stresses that request filtering merely reduces the risk before an update is installed and does not fix the WordPress code.
Temporary Restrictions on the Batch Route
The attack can be temporarily limited by blocking the REST API batch route. The filter must account for both methods of access: the direct path /wp-json/batch/v1 and the variant with the rest_route=/batch/v1 parameter. Blocking only the first address leaves the second path open.
Another temporary option involves prohibiting anonymous access to the REST API, or only to the /batch/v1 route. Such restrictions may disrupt the editor, mobile applications, integrations, and plugins that use the WordPress programming interface. They should therefore be viewed as a short-term measure rather than a replacement for updating.
What Administrators Should Do Now
Administrators need to confirm that their site runs on WordPress 6.8.6, 6.9.5, 7.0.2, or a newer patched version of the corresponding branch. The official archive confirms the release of WordPress 6.9.5 on July 17, 2026, and the project team recommends installing the update immediately because of the severity of the flaws.
Particular attention is required for sites where automatic updates are disabled, fail because of access permissions, or are managed by a hosting provider. Relying solely on the notice of forced patch distribution is not enough: the secure version should be verified directly in the WordPress dashboard or through server management tools.
Reviewing Logs After Patching
After updating, it is worth reviewing the web server and WAF logs for requests to the REST API batch route, especially requests with a complex nested structure. The mere presence of such requests does not prove a successful breach, since the route is used by legitimate clients. Suspicion should be raised by unusual anonymous requests that match the vulnerability-detection rules.
Rapid7 has prepared authenticated checks for InsightVM and Nexpose, whose release is scheduled for July 20. These checks can confirm the installed version and the state of the fix, though external scanning without system access does not always accurately determine whether a patch is present.
Why wp2shell Matters
The danger of wp2shell is tied not only to the level of access an attacker gains. WordPress is installed on an enormous number of public sites, and the standard configuration requires no plugins and does not enable a persistent object cache. Once the mechanism is published, the gap between a fix’s release and its actual installation becomes the primary risk factor.
The chain demonstrates how two flaws in different components can amplify each other. The SQL injection provided the ability to alter a database query but lacked a universal anonymous entry point. The batch-routing failure opened such an entry point but could not execute code without the injection. Uniting the two problems turned them into a critical vulnerability in WordPress core.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
