Critical wp2shell RCE Vulnerability Under Active Exploitation

Key Takeaways

• A critical pre-authentication Remote Code Execution (RCE) vulnerability, dubbed “wp2shell,” has been discovered in WordPress Core, affecting over 500 million websites.
• The exploit chain combines two distinct flaws: CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection).
• This vulnerability requires no authentication, plugins, or special configurations, making it extremely dangerous for unpatched WordPress installations.
• The flaw was uniquely discovered by an AI model (OpenAI’s GPT-5.6 Sol Ultra) at a minimal cost.
• Emergency patches have been released (WordPress 6.8.6, 6.9.5, 7.0.2, and 7.1 Beta 2), and active exploitation attempts are already being observed in the wild.

A severe pre-authentication remote code execution (RCE) vulnerability, now known as “wp2shell,” has been publicly disclosed in WordPress Core. This flaw enables completely unauthenticated attackers to fully compromise over half a billion WordPress sites globally, representing approximately 43% of all websites. The exploit chain is particularly concerning because it requires no prior conditions, such as valid user accounts, vulnerable plugins, or specific configurations, making default WordPress installations susceptible to immediate takeover.

The wp2shell chain comprises two distinct vulnerabilities: CVE-2026-63030, a REST API batch-route confusion issue, and CVE-2026-60137, a SQL injection flaw found in the author__not_in parameter of WP_Query. When chained together, these vulnerabilities allow an attacker to achieve full server compromise on a standard WordPress setup, even without any third-party plugins installed.

Discovery: An AI Model’s Breakthrough

In a groundbreaking development, the wp2shell vulnerability was uncovered by security researcher Adam Kues of Searchlight Cyber’s Assetnote research team. The discovery utilized an innovative approach: an AI-driven vulnerability research project powered by OpenAI’s GPT-5.6 Sol Ultra model. Kues adapted a prompt initially designed by OpenAI for solving mathematical conjectures, redirecting it to analyze the WordPress core codebase.

The AI model was instructed to identify a pre-authentication-to-RCE chain, employing up to four parallel research agents over a period exceeding six hours. Crucially, Kues mandated that the model avoid consulting changelogs, Git history, or the internet to prevent it from simply diffing against patched versions. This forced the AI to discover the bug purely through first-principles code analysis. The model was also permitted to audit third-party dependencies if necessary to complete an exploit chain.

The AI successfully identified a pre-authentication SQL injection within the codebase. Kues, initially skeptical due to WordPress’s robust history against such vulnerabilities, validated the SQLi by extracting an administrator’s email address from a live test instance. Subsequently, he tasked the AI with escalating the SQLi to full RCE. Approximately four hours later, the model delivered a functional escalation chain. The entire discovery process, using a $200-per-month subscription, incurred a prorated compute cost of roughly $25. Kues remarked that understanding and documenting the AI-generated exploit chain took him significantly longer than the model took to develop it, describing the post-exploitation technique as “completely absurd” in its complexity.

wp2shell Exploit Chain

The Batch API Desynchronization Bug (CVE-2026-63030)

The primary flaw resides in the WordPress REST API batch endpoint (/wp-json/batch/v1), a feature introduced in WordPress 5.6 in 2020, which allows multiple API requests to be combined into a single call. Typically, each REST request follows a four-step process: parameter validation, sanitization, permission callback, and execution. However, the batch endpoint deviates from this by performing validation and execution in separate loops rather than serially.

If a request within a batch is malformed, the validation array records the error, but the corresponding array of resolved handlers is not updated synchronously. This desynchronization occurs due to a continue statement that skips array insertion on one side but not the other. Consequently, during execution, request N’s validated parameters can be erroneously applied to request N+1’s handler, effectively bypassing intended parameter sanitization. This flaw is categorized under CWE-436 (interpretation conflict) and has a CVSS v3.1 base score of 7.5 (High).

The SQL Injection Sink (CVE-2026-60137)

The desynchronization bug alone is insufficient without a vulnerable target. The identified sink is the author__not_in parameter within WP_Query, WordPress’s core class for constructing database queries. When this parameter is submitted as an array, WordPress correctly sanitizes each value using absint(). However, if it’s submitted as a raw scalar string, this sanitization step is entirely skipped, and the value is directly interpolated into a raw SQL NOT IN clause.

Under normal circumstances, this unsanitized path is unreachable because the public-facing author_exclude parameter is validated as an array of integers before ever reaching author__not_in. The batch-route desynchronization bug bypasses this crucial validation, allowing a scalar SQL payload to pass through untouched. Furthermore, since the underlying endpoint only supports GET requests (which the batch API doesn’t natively permit), the exploit employs a recursive, nested batch call to smuggle the GET request through the desync mechanism a second time. This vulnerability is classified under CWE-89 (SQL injection) and carries a CVSS v3.1 score of 9.1 (Critical).

Escalating a Read-Only SQLi to Full RCE

The SQL injection component of wp2shell is initially a “SELECT-only” data-leak bug, incapable of directly retrieving crackable plaintext credentials due to WordPress’s password hashing. The AI model, however, devised a sophisticated escalation path leveraging a series of secondary WordPress behaviors:

• In-memory post cache poisoning: The UNION-based SQLi can fabricate fake WP_Post objects, which are then cached in memory for the duration of a request.
• Embed cache abuse: WordPress’s shortcode caches referenced local posts as oembed_cache rows in the database without verifying the referenced post ID exists. This allows attackers to plant seemingly legitimate database rows.
• Cache/database reconciliation exploitation: When WordPress detects a mismatch between in-memory and database-cached post versions, it prioritizes the in-memory (attacker-controlled) values, effectively “popping” fabricated rows into existence as arbitrary post types.
• Customize changeset hijack: A customize_changeset post type stores drafted site-setting changes tagged with a user_id. Applying it temporarily assigns that user’s identity via wp_set_current_user(), including administrator privileges if user_id is forged as 1.
• Cycle-detection gadget: WordPress’s post-parent hierarchy cycle detection, designed to prevent infinite loops, can be abused to trigger secondary wp_update_post() calls, exposing otherwise-protected fields like post_content.
• Hook replay via parse_request: While briefly holding administrator context, the attacker triggers the parse_request action hook. This replays the entire original batch request, now with elevated privileges, enabling the creation of a new, persistent administrator account.

Once a rogue administrator account is established, the attacker can log in normally and upload a malicious plugin ZIP file, thereby achieving full remote code execution on the server. Kues noted that the AI model produced this entire exploit chain in just over 10 hours, expressing confidence that no human researcher could have achieved the same unassisted within that timeframe.

Affected and Patched Versions

The wp2shell vulnerability affects specific WordPress versions differently:

It’s important to note that the 6.8.x branch is only susceptible to the SQL injection component (CVE-2026-60137), as the batch-route confusion bug (CVE-2026-63030) was introduced in WordPress 6.9. Patched releases include WordPress 6.8.6, 6.9.5, and 7.0.2, along with 7.1 Beta 2 for the pre-release branch.

Disclosure and Patch Timeline

WordPress released emergency security updates on July 17, 2026, to address both vulnerabilities simultaneously. Given the critical nature of the flaw, the WordPress.org security team took the unusual step of enabling forced automatic updates for all supported installations running affected versions. This mechanism is typically reserved for crisis-level situations. However, administrators are still strongly advised to manually verify that these forced updates have successfully applied, as custom configurations, disabled auto-updates, or managed hosting environments can sometimes prevent them.

CVE-2026-60137 was also independently reported to the WordPress security team by researchers TF1T, dtro, and haongo, and was patched in the same release cycle as the RCE chain discovered by Kues. Searchlight Cyber initially withheld full technical exploitation details to provide site owners with a crucial window to patch their systems. During this period, they published a free, non-intrusive public scanner at wp2shell.com to allow administrators to check their exposure.

Public PoC Release and Active Exploitation

Despite Searchlight Cyber’s responsible disclosure timeline, public proof-of-concept (PoC) exploits began circulating on GitHub within approximately 24 hours. Searchlight Cyber confirmed that two other groups, Calif and Hacktron, had independently reproduced the full exploit chain even before additional PoCs became public. Multiple security vendors have since confirmed early real-world exploitation attempts.

Benjamin Harris, CEO of watchTowr, stated that the firm was “already seeing PoC exploits in circulation” and “the first signs of exploitation in the wild.” Maurice Fielenback, Hexastrike’s head of Cyber Threat Intelligence, reported that his firm continued to observe “attempted and successful wp2shell exploitation” and had “handled several confirmed and suspected incidents” after flagging initial attempts the previous Sunday. Some publicly released exploit variants target administrator password hashes via the SQL injection for offline brute-forcing, while others directly implement the full pre-authentication RCE chain without needing to crack any passwords.

Cloudflare also reported that the vulnerable code path is specifically reachable when a persistent object cache is not in use on the target server. The company has deployed WAF protections against both CVEs across all customer plans, including its free tier, for proxied domains.

What You Should Do

Upgrading WordPress core to a patched version is the only complete and recommended fix. Defenders should take the following concrete, practical steps:

• Update Immediately: Upgrade WordPress to the latest patched versions: 7.0.2, 6.9.5, or 6.8.6, depending on your current branch. This can be done via the WordPress Dashboard’s Updates screen or by downloading the release directly from WordPress.org.
• Verify Auto-Updates: Confirm that the forced automatic update has successfully applied on all managed sites, as custom configurations or disabled auto-updates can prevent its installation.
• Check Exposure: Use the free wp2shell.com scanner or manually query the batch endpoint to confirm your site’s current exposure status.
• Implement Temporary WAF Blocks (If Patching is Delayed): If immediate patching is not feasible, block both /wp-json/batch/v1 and its query-string variant ?rest_route=/batch/v1 at your Web Application Firewall (WAF) or web server level. Be aware that blocking only the path form leaves the query-string route exploitable.
• Install Interim REST API Restriction Plugin: As a temporary measure, consider installing a plugin or must-use plugin that rejects anonymous REST API batch requests, for example, by using the rest_pre_dispatch hook.
• Review Logs and Systems for Compromise: On any site that ran an affected version, review logs for suspicious requests to the batch endpoint, check for unexpected new administrator accounts, and inspect for unfamiliar plugins, themes, or altered rows in wp_posts and wp_options tables.

Security vendors emphasize that WAF-level blocking and REST API restriction plugins are strictly temporary stopgaps that may disrupt legitimate site functionality. Core version upgrades remain the only durable remediation. The discovery of wp2shell is significant not only for its technical severity but also for its method of discovery, signaling a new era in vulnerability research where AI models can uncover critical flaws with minimal human and financial investment.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.