WordPress wp2shell Vulnerabilities Exploited in the Wild (CVE-2026-63030 & CVE-2026-60137)

Threat actors have released public exploit code for the WordPress core remote code execution vulnerabilities, named wp2shell. Tracked as CVE-2026-63030 and CVE-2026-60137, the vulnerabilities can be chained together to achieve pre-authentication remote code execution.

Adam Kues of Searchlight Cyber discovered and reported the vulnerability to WordPress. The article mentioned that more than 500 million websites use WordPress, which enhances the impact of the vulnerabilities multifold.

The Searchlight Cyber team has responsibly withheld the technical details of the vulnerability’s exploitation.

The two vulnerabilities

CVE-2026-63030 is a REST API batch-route confusion vulnerability that can be chained with the SQL injection vulnerability to achieve remote code execution.

The second vulnerability, CVE-2026-60137, is an SQL injection flaw in the author__not_in parameter of WP_Query.

The publicly available exploit code

While the Searchlight Cyber is not releasing technical details, multiple researchers have published public proof-of-concept exploits on GitHub.

Some publicly available exploits combine the two vulnerabilities to extract WordPress password hashes via SQL injection, then crack an administrator password to log in, upload a malicious plugin, and execute commands.

Affected Versions

CVE-2026-63030:

• WordPress 6.9.0 – 6.9.4
• WordPress 7.0.0 – 7.0.1

CVE-2026-60137:

• WordPress 6.8.0 – 6.8.5
• WordPress 6.9.0 – 6.9.4
• WordPress 7.0.0 – 7.0.1

Workaround

Users can temporarily protect their instance by blocking anonymous access to the batch API, either by:

• Installing a plugin that blocks anonymous access to the rest API entirely; or 
• Blocking /wp-json/batch/v1 and ?rest_route=/batch/v1 at a WAF level.

Mitigation

CVE-2026-63030:

• WordPress 6.9.5
• WordPress 7.0.2

CVE-2026-60137:

• WordPress 6.8.6
• WordPress 6.9.5
• WordPress 7.0.2

The advisory states, “Due to the severity, the WordPress.org team has enabled forced updates via the auto-update system for sites running affected versions.”

For more information, please refer to the WordPress Security Advisory.

Qualys Detection

Qualys customers can scan their devices with QIDs 734738 and 734739 to detect vulnerable assets.

Continue to follow Qualys Threat Protection for more coverage on the latest vulnerabilities.

References
https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/