Critical WordPress RCE Vulnerability: wp2shell (CVE-2026-63030, CVE-2026-60137)

Overview

WordPress powers over 40% of all websites on the internet, making it the single most widely deployed content management system in the world. From personal blogs to Fortune 500 corporate sites, government portals, and e-commerce platforms, WordPress underpins a massive share of the web’s infrastructure. When a critical vulnerability hits WordPress Core, the blast radius is unlike anything else in the CMS landscape.

Two critical vulnerabilities tracked as CVE-2026-63030 and CVE-2026-60137, collectively known as wp2shell, enable pre-authentication remote code execution (RCE) in WordPress Core. Discovered by Adam Kues of Searchlight Cyber, these flaws require no preconditions and can be exploited by an anonymous user against a stock WordPress installation. With an estimated 500+ million active WordPress sites, this vulnerability represents one of the largest attack surfaces for a single CVE in recent history.

Affected Versions

Branch Vulnerable Versions Patched Version 7.x 7.0.0, 7.0.1 7.0.2 6.x 6.9.0, 6.9.4 6.9.5

Versions prior to 6.9.0 are not affected.

Technical Details

The vulnerability exploits the WordPress REST API batch endpoint (/wp-json/batch/v1). This endpoint, available to unauthenticated users by default, can be abused to achieve full remote code execution on the underlying server.

Key characteristics of this vulnerability:

• Attack vector: Network (unauthenticated, no user interaction required)

• Complexity: Low

• Impact: Full server compromise, arbitrary code execution

• Preconditions: None. Works on default WordPress installations

Immediate Remediation

Primary Fix: Upgrade WordPress

Update to one of the patched versions immediately:

• WordPress 7.0.2 (for 7.x installations)

• WordPress 6.9.5 (for 6.x installations)

Temporary Mitigations

If you cannot patch immediately, apply one or more of the following mitigations:

1. Block the vulnerable endpoint at the WAF level

Configure your web application firewall or reverse proxy to block requests matching:

• Path: /wp-json/batch/v1

• Query parameter: rest_route=/batch/v1

2. Disable unauthenticated REST API access

Install the “Disable WP REST API” plugin to restrict REST API access to authenticated users only.

3. Deploy a custom authentication filter

Add a lightweight plugin that requires authentication for batch API requests. The wp2shell advisory page provides a reference implementation.

Detection and Response

Organizations should take the following steps beyond patching:

• Review web server logs for unusual requests to /wp-json/batch/v1, particularly from unexpected sources

• Check for indicators of compromise including new admin accounts, modified core files, unfamiliar plugins, or web shells

• Rotate credentials for all WordPress administrator accounts and database users if compromise is suspected

Recommendations / Checklist

Organizations using CYBERDEFENSE.AI are protected against unauthenticated RCE attacks by default through our built-in threat detection and prevention capabilities. However, we strongly recommend updating WordPress to the patched version to eliminate the underlying vulnerability entirely.

Here’s the checklist to avoid issues:

1. Patch now. This is the highest priority action. The lack of authentication requirements makes this trivially exploitable at scale.

2. Audit your WordPress inventory. Many organizations have WordPress instances they have lost track of. Use asset discovery to identify all WordPress deployments.

3. Implement defense in depth. WAF rules blocking the batch endpoint provide an additional layer even after patching.

4. Monitor for exploitation. Automated exploitation is likely given the low barrier to entry. Proactive monitoring is essential.

References

• CVE-2026-63030

• CVE-2026-60137