Public exploits are now available for two serious WordPress Core vulnerabilities known collectively as wp2shell.
Attackers can combine the WordPress wp2shell flaws to execute malicious code on vulnerable websites without authentication. Security researchers have also detected early signs of exploitation in real attacks.
The complete attack chain affects WordPress 6.9.0 through 6.9.4 and versions 7.0.0 through 7.0.1. Administrators should update immediately to WordPress 6.9.5 or 7.0.2.
Two Vulnerabilities Create wp2shell Attack
The wp2shell attack does not rely on one security flaw. Instead, it combines two separate vulnerabilities in WordPress Core.
Researchers track the first vulnerability as CVE-2026-63030. It involves confusion within a WordPress REST API batch route.
This flaw first appeared in WordPress 6.9. Attackers can combine it with a separate SQL injection vulnerability to achieve remote code execution.
The second flaw, CVE-2026-60137, affects the author__not_in parameter within WP_Query. It allows attackers to inject malicious SQL commands into vulnerable websites.
The SQL injection issue affects WordPress 6.8 and later. However, attackers cannot use it for the complete wp2shell remote code execution chain on WordPress 6.8.
That is because the required REST API vulnerability did not appear until WordPress 6.9.
Attack Requires No Authentication
The WordPress wp2shell flaws create a particularly serious risk because attackers may exploit them remotely without logging in.
According to the researchers who discovered the vulnerabilities, an anonymous attacker can target a default WordPress installation. The attack does not require vulnerable plugins or special configuration settings.
Therefore, even websites running a standard WordPress setup may be at risk.
Successful exploitation could allow an attacker to run commands on the underlying server. From there, the intruder could install malware, steal information, alter website content, or create persistent access.
The attacker may also use the compromised website to distribute malware or target visitors.
Public Exploits Increase the Threat
Multiple proof-of-concept exploits for the WordPress wp2shell flaws have appeared publicly.
Some versions use SQL injection to extract WordPress password hashes. Attackers can then attempt to crack an administrator password, enter the dashboard, and upload a malicious plugin.
Once installed, that plugin can execute commands on the server.
However, other public exploits claim they can achieve remote code execution without obtaining administrator credentials. This approach matches the original description of the vulnerability chain.
Security researchers have not confirmed that every public exploit works as advertised. Nevertheless, they have already observed early signs of exploitation against real websites.
The availability of public code makes widespread attacks more likely. Criminals can now study and modify the existing exploits instead of developing an attack from the beginning.
Affected WordPress Versions
The full wp2shell remote code execution chain affects the following versions:
- WordPress 6.9.0 through 6.9.4
- WordPress 7.0.0 through 7.0.1
The SQL injection flaw also affects WordPress 6.8.0 through 6.8.5. However, those versions do not contain the REST API bug required for the full remote code execution attack.
WordPress fixed both vulnerabilities in versions 6.9.5 and 7.0.2.
Because of the severity, the WordPress security team enabled forced automatic updates for supported websites running affected versions.
However, website owners should not assume that the update completed successfully. Administrators should check the installed version manually.
Temporary Protections Available
Organizations that cannot update immediately can apply temporary protections.
One option is to block anonymous access to the WordPress REST API. However, this approach may affect plugins or website features that depend on the API.
Administrators can also block the following routes through a web application firewall:
/wp-json/batch/v1?rest_route=/batch/v1
These measures can reduce exposure to the REST API portion of the attack chain. Nevertheless, they do not replace the official security update.
Some web infrastructure providers have also introduced firewall rules to block exploitation attempts. These protections cover both the SQL injection issue and the REST API batch-route vulnerability.
Still, websites that sit behind a firewall should install the patched WordPress version.
Administrators Should Patch Immediately
Website owners should update to WordPress 6.9.5 or 7.0.2 as soon as possible.
After updating, administrators should check for signs that attackers accessed the website before the patch arrived. Suspicious administrator accounts, modified files, unfamiliar plugins, and unexpected server processes may indicate a compromise.
Security teams should also review web server logs for unusual REST API requests. In addition, they should examine database activity and recent changes to WordPress files.
With public exploits circulating and attacks beginning to appear, delaying the update creates an unnecessary risk.
0 responses to “WordPress wp2shell Flaws Face Active Exploitation”