Organizations running WordPress should prioritize installing the latest WordPress security update after public proof-of-concept (PoC) exploits were released for WordPress vulnerabilities that can be chained to achieve remote code execution (RCE).
“This is going to hurt. WordPress runs on hundreds of millions of websites globally. Some of those will be auto-patched by their hosting providers, but plenty will not, and that is where the damage will be done,” said Benjamin Harris, CEO and founder at watchTowr, in an email to eSecurityPlanet.
Key Takeaways of the WordPress Vulnerabilities
- Public proof-of-concept (PoC) exploits are now available for the wp2shell attack chain affecting WordPress Core.
- Chaining CVE-2026-63030 and CVE-2026-60137 enables pre-authentication remote code execution on affected WordPress 6.9.x and 7.0.x installations.
- The vulnerabilities affect default WordPress installations and do not require plugins or custom configurations for exploitation.
- Public exploits demonstrate multiple attack paths, including administrator credential theft and pre-authentication remote code execution.
- Organizations should immediately update to the latest WordPress security release and verify that affected systems have been successfully patched.
How the WordPress wp2shell RCE Attack Works
The attack chain, dubbed wp2shell, combines two vulnerabilities — CVE-2026-63030 and CVE-2026-60137 — to achieve pre-authentication remote code execution against default WordPress installations running versions 6.9.x and 7.0.x.
The flaws were discovered by Searchlight Cyber, which reported that the attack has no preconditions and can be exploited against a stock WordPress installation without requiring plugins or custom configurations.
CVE-2026-63030
The first vulnerability, CVE-2026-63030, is a REST API batch-route confusion flaw introduced in WordPress 6.9.
This vulnerability allows attackers to abuse the REST API’s batch processing functionality in ways that were not intended.
On its own, the flaw does not provide remote code execution, but it serves as a critical component of the broader wp2shell attack chain.
CVE-2026-60137
The second vulnerability, CVE-2026-60137, is a high-severity SQL injection flaw affecting the author__not_in parameter in WP_Query.
The vulnerability impacts WordPress 6.8 and later, allowing attackers to manipulate database queries through insufficient input handling.
By chaining the two vulnerabilities together, an unauthenticated attacker can achieve pre-authentication remote code execution against WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1.
Although the SQL injection vulnerability also affects WordPress 6.8.x releases, those versions are not vulnerable to the complete wp2shell attack because they do not include the REST API batch-route confusion flaw required to complete the exploit chain.
The public release of exploit code has further increased the urgency for organizations running affected versions.
Multiple PoCs have been published on GitHub since the security updates were released.
Some demonstrate using the SQL injection vulnerability to extract WordPress password hashes, crack administrator credentials, upload a malicious plugin, and execute arbitrary commands.
Other PoCs demonstrate pre-authentication remote code execution without requiring administrator credentials, aligning with Searchlight Cyber’s description of the attack chain.
How to Mitigate the WordPress RCE Vulnerabilities
Security teams should take steps to reduce exposure, monitor for signs of exploitation, and prepare for potential recovery if systems have already been compromised.
- Update all affected WordPress installations to the latest security release and verify that automatic security updates completed successfully.
- Use web application firewall (WAF) protections to help reduce exposure until affected systems can be patched.
- Inventory internet-facing WordPress sites and identify any instances still running vulnerable versions.
- Monitor web server and WordPress logs for suspicious REST API requests, SQL injection attempts, unexpected administrator accounts, unauthorized plugin uploads, and other indicators of compromise.
- If compromise is suspected, rotate administrator credentials, invalidate active sessions, and perform file integrity checks to identify unauthorized changes or web shells.
- Test incident response plans using remote code execution (RCE) scenarios and validate backup and recovery procedures.
Together, these measures can help organizations reduce their exposure while strengthening their overall resilience.
Bottom Line
While the available patches address the vulnerabilities, organizations should take the opportunity to review the security of their internet-facing WordPress deployments.
They should also validate that their detection, incident response, and recovery capabilities are ready if needed.
While these updates address the immediate risk, they also provide an opportunity to evaluate how Zero Trust can help limit exposure across internet-facing environments.