Patch now: WordPress Core “wp2shell” chain (CVE-2026-60137, CVE-2026-63030)

Two WordPress Core issues can be combined into a serious pre‑authentication remote code execution attack on certain versions. Public proof‑of‑concept exploits are circulating, and multiple vendors report protective rules while site owners rush to update. This post summarizes what’s confirmed, what’s still unclear, and the most practical next steps based on the official advisories and trusted reports.

What’s vulnerable and what’s fixed

The “wp2shell” label used in reporting refers to a chain of two separate Core flaws:

• CVE-2026-60137: An unauthenticated SQL injection in the author__not_in parameter of WP_Query.
• CVE-2026-63030: A REST API batch endpoint route‑confusion issue that, when combined with the SQL injection above, enables remote code execution.

Based on the GitHub security advisories and vendor notices linked below:

• The SQL injection (CVE-2026-60137) affects WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, and 7.0.0–7.0.1. It is fixed in 6.8.6, 6.9.5, and 7.0.2. The advisory also notes the fix is present in 7.1 beta2.
• The RCE chain (CVE-2026-63030 combined with CVE-2026-60137) affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. It is fixed in 6.9.5 and 7.0.2.
• WordPress initiated forced automatic security updates for supported sites on affected versions, but administrators should still verify they are on a patched release.

Wordfence and Cloudflare state they have deployed firewall protections for the attack chain. These rules can reduce risk while patching, but they are not a substitute for updating Core.

Why it matters

WordPress powers a large portion of the web. A chain that enables unauthenticated code execution against default installs of specific versions is rare and high‑impact. BleepingComputer reports that public PoC exploits are available and cites early signs of in‑the‑wild exploitation from a security firm. In short: update first, mitigate where you must, and confirm.

What to do now

• Update WordPress Core to a fixed version:
  • 7.0.2 or later if you’re on the 7.0 branch.
  • 6.9.5 or later if you’re on the 6.9 branch.
  • 6.8.6 if you’re on 6.8 and cannot move to a newer major yet.
• Verify that automatic security updates applied successfully; do not assume they did.
• If immediate updating is not possible, apply temporary risk reduction as reported:
  • Block anonymous access to the REST API, or specifically block /wp-json/batch/v1 and ?rest_route=/batch/v1 at your WAF.
  • If you use Cloudflare or Wordfence, ensure their latest WAF rules are active.
• Test exposure with trusted references only. Searchlight Cyber published a checker at wp2shell.com; use such tools cautiously and prioritize patching over scanning.

What’s confirmed vs. still unclear

Confirmed from advisories and vendor posts:

• The SQL injection resides in author__not_in handling within WP_Query and is exploitable without authentication in affected versions.
• The REST API batch route‑confusion bug, introduced in 6.9, lets attackers chain the SQL injection to reach code execution in 6.9.x and 7.0.x before the fixes.
• Fixed versions are 6.8.6, 6.9.5, and 7.0.2 (with 7.1 beta2 also including the patch per the advisory).
• Public PoCs exist, and at least one security firm has reported early exploitation following those releases.

Still unclear or evolving:

• Technical exploitation specifics are being deliberately withheld by some parties to allow time for patching.
• Public PoCs vary in approach. Some claim true pre‑authentication RCE; others demonstrate database access and credential compromise as a step toward execution. Reporting indicates the chain can be pre‑auth, but not all details are public.

Given this uncertainty, the safest assumption is that reachable sites on affected versions are at material risk until fully updated.

Practical guardrails and caveats

The SQL injection can be triggered when untrusted input is passed into author__not_in. Even if your site appears locked down, third‑party themes or plugins could influence how that parameter is used. Treat this as a Core issue and patch regardless of your plugin stack.

Web application firewalls can blunt exploit attempts, but signatures will evolve alongside public PoCs, and bypasses are always possible. Use WAF rules as an interim layer only.

References

• WordPress advisory for CVE-2026-60137 (SQL injection in author__not_in): https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
• WordPress advisory for CVE-2026-63030 (REST API batch route confusion): https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
• WordPress 7.0.2 security release announcement: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
• Wordfence PSA on the patched chain: https://www.wordfence.com/blog/2026/07/psa-wordpress-core-patched-unauthenticated-remote-code-execution-vulnerability-chain/
• BleepingComputer coverage of “wp2shell” exploits and mitigations: https://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/

Staying current on Core updates and applying them quickly remains the most effective defense. For this pair of CVEs, patching is the clear, evidence‑based fix—and the sooner, the better.

Alex Mira

Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Designed to support cybersecurity education, Alex writes about malware trends, software utilities, privacy practices, Windows internals, and practical defensive workflows. Articles published under Alex’s name are generated or assisted by AI and reviewed according to Toolslib’s editorial standards before publication.