<- ALL CYBER NEWS
Critical
WordPress, wp2shell, CVE-2026-63030, CVE-2026-60137, RCE, SQL injection, CMS
WordPress wp2shell RCE (CVE-2026-63030): Public Exploits, Patch Now
WordPress Core wp2shell RCE chains CVE-2026-63030 and CVE-2026-60137 for unauthenticated remote code execution. Public exploits are out and exploitation has begun.
WordPress "wp2shell" is an unauthenticated remote code execution chain in WordPress Core (CVE-2026-63030, CVSS 9.8, plus CVE-2026-60137) that combines a REST API batch-route confusion bug with a SQL injection to run attacker code. Public exploits are on GitHub and in-the-wild exploitation has started, update to WordPress 6.9.5 or 7.0.2 now.
What happened. Two WordPress Core flaws chain into unauthenticated RCE, nicknamed wp2shell. CVE-2026-63030 (CVSS 9.8, Critical, CWE-436) is a REST API batch-route confusion issue introduced in WordPress 6.9. CVE-2026-60137 (CVSS 5.9, CWE-89) is a SQL injection in the author__not_in parameter of WP_Query. Alone the SQLi is limited, but chained through the batch endpoint it yields remote code execution. Multiple public proof-of-concept exploits have been posted to GitHub, and security firm watchTowr reports "the first signs of in-the-wild exploitation."
Which WordPress versions are affected by wp2shell?
Version range | Status |
|---|---|
WordPress 6.9.0 – 6.9.4 | Vulnerable to full RCE chain |
WordPress 7.0.0 – 7.0.1 | Vulnerable to full RCE chain |
WordPress 6.8.0 – 6.8.5 | SQLi (CVE-2026-60137) only, no RCE chain |
WordPress 6.9.5 | Patched |
WordPress 7.0.2 | Patched |
Is wp2shell being exploited in the wild?
Yes, early exploitation has been reported by watchTowr, and working public exploits are already circulating on GitHub. EPSS for CVE-2026-63030 sits in the 94th percentile (~8.9%), and neither CVE is in CISA KEV yet, but the presence of public exploits plus in-the-wild reports means unpatched sites should be treated as urgent.
How do I fix wp2shell?
Update WordPress Core to 6.9.5 or 7.0.2 immediately.
If you cannot patch now, block
/wp-json/batch/v1and?rest_route=/batch/v1at your WAF.Restrict anonymous REST API access with a plugin or WAF rule.
Cloudflare WAF protections are available on all plans as a stopgap.
Who's affected. Any self-managed WordPress site on 6.9.0–6.9.4 or 7.0.0–7.0.1, the world's most widely deployed CMS. Sites on 6.8.x are exposed to SQL injection but not the full RCE chain; they should still update.
Our read. wp2shell is a textbook case of severity emerging from composition: a "medium" SQLi (CVSS 5.9) and a routing bug become an unauthenticated CVSS 9.8 shell when chained. Scanners that grade CVEs one at a time miss exactly this. And the timeline is brutal, patches and public exploits landed together, so the window to act is measured in hours. This is why we test the way attackers actually operate: chaining primitives against a live target, not checking version numbers against a list.
Reporting by BleepingComputer and SecurityWeek; exploitation detail per watchTowr; CVSS and CWE per NVD and the WordPress security advisories. Sources linked above. Related: our continuous verification approach.