// NEXUSVOID CYBER NEWS
<- ALL CYBER NEWS
Critical
WordPress, wp2shell, CVE-2026-63030, CVE-2026-60137, RCE, SQL injection, CMS
WordPress wp2shell RCE (CVE-2026-63030): Public Exploits, Patch Now
WordPress Core wp2shell RCE chains CVE-2026-63030 and CVE-2026-60137 for unauthenticated remote code execution. Public exploits are out and exploitation has begun.
WordPress "wp2shell" is an unauthenticated remote code execution chain in WordPress Core (CVE-2026-63030, CVSS 9.8, plus CVE-2026-60137) that combines a REST API batch-route confusion bug with a SQL injection to run attacker code. Public exploits are on GitHub and in-the-wild exploitation has started — update to WordPress 6.9.5 or 7.0.2 now.
What happened. Two WordPress Core flaws chain into unauthenticated RCE, nicknamed wp2shell. CVE-2026-63030 (CVSS 9.8, Critical, CWE-436) is a REST API batch-route confusion issue introduced in WordPress 6.9. CVE-2026-60137 (CVSS 5.9, CWE-89) is a SQL injection in the author__not_in parameter of WP_Query. Alone the SQLi is limited, but chained through the batch endpoint it yields remote code execution. Multiple public proof-of-concept exploits have been posted to GitHub, and security firm watchTowr reports "the first signs of in-the-wild exploitation."
Which WordPress versions are affected by wp2shell?
Version range | Status |
|---|---|
WordPress 6.9.0 – 6.9.4 | Vulnerable to full RCE chain |
WordPress 7.0.0 – 7.0.1 | Vulnerable to full RCE chain |
WordPress 6.8.0 – 6.8.5 | SQLi (CVE-2026-60137) only — no RCE chain |
WordPress 6.9.5 | Patched |
WordPress 7.0.2 | Patched |
Is wp2shell being exploited in the wild?
Yes — early exploitation has been reported by watchTowr, and working public exploits are already circulating on GitHub. EPSS for CVE-2026-63030 sits in the 94th percentile (~8.9%), and neither CVE is in CISA KEV yet, but the presence of public exploits plus in-the-wild reports means unpatched sites should be treated as urgent.
How do I fix wp2shell?
Update WordPress Core to 6.9.5 or 7.0.2 immediately.
If you cannot patch now, block
/wp-json/batch/v1and?rest_route=/batch/v1at your WAF.Restrict anonymous REST API access with a plugin or WAF rule.
Cloudflare WAF protections are available on all plans as a stopgap.
Who's affected. Any self-managed WordPress site on 6.9.0–6.9.4 or 7.0.0–7.0.1 — the world's most widely deployed CMS. Sites on 6.8.x are exposed to SQL injection but not the full RCE chain; they should still update.
Our read. wp2shell is a textbook case of severity emerging from composition: a "medium" SQLi (CVSS 5.9) and a routing bug become an unauthenticated CVSS 9.8 shell when chained. Scanners that grade CVEs one at a time miss exactly this. And the timeline is brutal — patches and public exploits landed together, so the window to act is measured in hours. This is why we test the way attackers actually operate: chaining primitives against a live target, not checking version numbers against a list.
Reporting by BleepingComputer and SecurityWeek; exploitation detail per watchTowr; CVSS and CWE per NVD and the WordPress security advisories. Sources linked above. Related: our continuous verification approach.