Waspada DigitalVerified developments. Evidence. Practical next steps.

Cyber Alerts

MA-1470.072026: MyCERT Advisory - Critical Pre-Authentication Remote Code Execution in WordPress Core ("wp2shell")

Verified Officially confirmed Active exploitation confirmed

On 17 July 2026, WordPress released versions 6.9.5 and 7.0.2 to address a critical, unauthenticated Remote Code Execution (RCE) vulnerability in WordPress core, publicly referred to as "wp2shell". The flaw resides in the REST API batch-route handling and involves a route-confusion condition combined with an SQL injection weakness, allowing an anonymous attacker to execute arbitrary code on a default WordPress installation with no plugins required. The vulnerability was discovered and responsibly disclosed by a researcher at Assetnote (Searchlight Cyber) through the official WordPress HackerOne program. WordPress has enabled forced auto-updates to push the patch to affected sites, though sites with auto-updates disabled must verify and patch manually. 2.0 Technical DetailsVulnerability class: REST API batch-route confusion combined with SQL Injection, leading to Remote Code Execution. Attack vector: Unauthenticated / anonymous HTTP request — no prior access or credentials required.Affected component: WordPress REST API batch endpoint (/wp-json/batch/v1 and the rest_route=/batch/v1 query-string equivalent).Files modified in the fix: wp-includes/rest-api/class-wp-rest-server.php, wp-includes/class-wp-query.php, wp-includes/rest-api.php.CVE-2026-63030 — the REST API batch-route confusion / RCE chain; CVSS 7.5 per the official GitHub Security Advisory (GHSA-ff9f-jf42-662q), rated Critical severity by WordPress; some third-party exploit-tracking listings report scores as high as 9.8. Affects WordPress 6.9 and later.CVE-2026-60137 — the underlying SQL injection (in the author__not_in parameter of WP_Query), affecting WordPress 6.8 and later; fixed in 6.8.6 for the 6.8 branch.Per Cloudflare's analysis, the RCE path is reachable specifically when a persistent object cache is not enabled on the target site.The two CVEs must be chained together to achieve full remote code execution; CVE-2026-60137 alone permits blind SQL injection but not code execution. Full technical exploitation details have not been publicly released by the discovering researcher; a self-service checker has been made available to allow site owners to test their own instances. 3.0 Affected Versions Affected Branch Fixed In 6.9.0 – 6.9.4 6.9.5 7.0.0 – 7.0.1 7.0.2 7.1 (beta) 7.1 beta2 (fix included) 6.8.x (unrelated SQLi) 6.8.6

First observed
29 Jul 2026
Last checked
01 Aug 2026
Evidence records
4
Publication state
Published

What happened?

Current assessment

On 17 July 2026, WordPress released versions 6.9.5 and 7.0.2 to address a critical, unauthenticated Remote Code Execution (RCE) vulnerability in WordPress core, publicly referred to as "wp2shell". The flaw resides in the REST API batch-route handling and involves a route-confusion condition combined with an SQL injection weakness, allowing an anonymous attacker to execute arbitrary code on a default WordPress installation with no plugins required. The vulnerability was discovered and responsibly disclosed by a researcher at Assetnote (Searchlight Cyber) through the official WordPress HackerOne program. WordPress has enabled forced auto-updates to push the patch to affected sites, though sites with auto-updates disabled must verify and patch manually. 2.0 Technical DetailsVulnerability class: REST API batch-route confusion combined with SQL Injection, leading to Remote Code Execution. Attack vector: Unauthenticated / anonymous HTTP request — no prior access or credentials required.Affected component: WordPress REST API batch endpoint (/wp-json/batch/v1 and the rest_route=/batch/v1 query-string equivalent).Files modified in the fix: wp-includes/rest-api/class-wp-rest-server.php, wp-includes/class-wp-query.php, wp-includes/rest-api.php.CVE-2026-63030 — the REST API batch-route confusion / RCE chain; CVSS 7.5 per the official GitHub Security Advisory (GHSA-ff9f-jf42-662q), rated Critical severity by WordPress; some third-party exploit-tracking listings report scores as high as 9.8. Affects WordPress 6.9 and later.CVE-2026-60137 — the underlying SQL injection (in the author__not_in parameter of WP_Query), affecting WordPress 6.8 and later; fixed in 6.8.6 for the 6.8 branch.Per Cloudflare's analysis, the RCE path is reachable specifically when a persistent object cache is not enabled on the target site.The two CVEs must be chained together to achieve full remote code execution; CVE-2026-60137 alone permits blind SQL injection but not code execution. Full technical exploitation details have not been publicly released by the discovering researcher; a self-service checker has been made available to allow site owners to test their own instances. 3.0 Affected Versions Affected Branch Fixed In 6.9.0 – 6.9.4 6.9.5 7.0.0 – 7.0.1 7.0.2 7.1 (beta) 7.1 beta2 (fix included) 6.8.x (unrelated SQLi) 6.8.6

Why it matters

CISA includes this vulnerability in its Known Exploited Vulnerabilities catalog.

Who is affected?

Affected products and groups

  • Organisation: WordPress — Vendor or project named in the CISA KEV catalog.
  • Product: Core — Product listed by CISA for WordPress.

What should you do now?

Actions from official guidance

For technical teams

  1. Verify the installed WordPress version and confirm it has been updated to 6.9.5, 7.0.2, or later. Do not assume forced auto-update has applied, check the actual running version.For sites on the 6.8.x branch, update to 6.8.6 to address the related SQL injection issue.Re-enable and confirm WordPress core auto-updates are functioning where feasible. Official source
  2. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Official source
  3. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Official source

For everyone

  1. If immediate patching is not possible, apply one of the following stop-gap mitigations: Official source
  2. Block anonymous access to the REST API batch endpoint at the WAF/reverse proxy level for both /wp-json/batch/v1 and the rest_route=/batch/v1 query-string form must be blocked, as filtering only one leaves the route exploitable.Disable the WordPress REST API for unauthenticated users using a vetted plugin, if the site does not depend on public REST API access.Deploy a temporary drop-in that rejects anonymous /batch/v1 requests at the rest_pre_dispatch hook. Official source
  3. Monitor web server and WAF logs for anomalous requests to the batch REST endpoint.Review sites for indicators of compromise (unexpected admin accounts, modified core files, unfamiliar scheduled tasks/webshells) if patching was delayed.Note that CVE IDs have now been assigned (CVE-2026-63030, CVE-2026-60137); CVE-based vulnerability scanners should be updated to detect this issue, but track remediation by WordPress version number as a backstop. Official source
  4. Generally, MyCERT advises users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied. Official source

Which sources support it?

Evidence and official sources

  1. CISA Known Exploited VulnerabilitiesOfficial source
    WordPress Core SQL Injection Vulnerability (CVE-2026-60137)

    WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.

    Published 21 Jul 2026 · Retrieved 01 Aug 2026
  2. CISA Known Exploited VulnerabilitiesOfficial source
    WordPress Core Interpretation Conflict Vulnerability (CVE-2026-63030)

    WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.

    Published 21 Jul 2026 · Retrieved 01 Aug 2026
  3. NIST National Vulnerability DatabaseOfficial source
    CVE-2026-60137: WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a…

    WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

    Published 17 Jul 2026 · Retrieved 30 Jul 2026
  4. MyCERTOfficial source
    MA-1470.072026: MyCERT Advisory - Critical Pre-Authentication Remote Code Execution in WordPress Core ("wp2shell")

    On 17 July 2026, WordPress released versions 6.9.5 and 7.0.2 to address a critical, unauthenticated Remote Code Execution (RCE) vulnerability in WordPress core, publicly referred to as "wp2shell". The flaw resides in the REST API batch-route handling and involves a route-confusion condition combined with an SQL injection weakness, allowing an anonymous attacker to execute arbitrary code on a default WordPress installation with no plugins required. The vulnerability was discovered and responsibly disclosed by a researcher at Assetnote (Searchlight Cyber) through the official WordPress HackerOne program. WordPress has enabled forced auto-updates to push the patch to affected sites, though sites with auto-updates disabled must verify and patch manually. 2.0 Technical DetailsVulnerability class: REST API batch-route confusion combined with SQL Injection, leading to Remote Code Execution. Attack vector: Unauthenticated / anonymous HTTP request — no prior access or credentials required.Affected component: WordPress REST API batch endpoint (/wp-json/batch/v1 and the rest_route=/batch/v1 query-string equivalent).Files modified in the fix: wp-includes/rest-api/class-wp-rest-server.php, wp-includes/class-wp-query.php, wp-includes/rest-api.php.CVE-2026-63030 — the REST API batch-route confusion / RCE chain; CVSS 7.5 per the official GitHub Security Advisory (GHSA-ff9f-jf42-662q), rated Critical severity by WordPress; some third-party exploit-tracking listings report scores as high as 9.8. Affects WordPress 6.9 and later.CVE-2026-60137 — the underlying SQL injection (in the author__not_in parameter of WP_Query), affecting WordPress 6.8 and later; fixed in 6.8.6 for the 6.8 branch.Per Cloudflare's analysis, the RCE path is reachable specifically when a persistent object cache is not enabled on the target site.The two CVEs must be chained together to achieve full remote code execution; CVE-2026-60137 alone permits blind SQL injection but not code execution. Full technical exploitation details have not been publicly released by the discovering researcher; a self-service checker has been made available to allow site owners to test their own instances. 3.0 Affected Versions Affected Branch Fixed In 6.9.0 – 6.9.4 6.9.5 7.0.0 – 7.0.1 7.0.2 7.1 (beta) 7.1 beta2 (fix included) 6.8.x (unrelated SQLi) 6.8.6

    Published Just published · Retrieved 01 Aug 2026