WordPress wp2shell Unauthenticated RCE via SQLi and REST API Confusion (CVE-2026-60137/CVE-2026-6030) Advisory

Vulnerability Overview Vulnerability Name: wp2shell Vulnerability Type: Unauthenticated Remote Code Execution (RCE) Discovery Date: July 17, 2026 Reporter: Adam Kues of Assetnote / Searchlight Cyber Vulnerability IDs: CVE-2026-60137 and CVE-2026-6030 Vulnerability Description: This vulnerability chain involves two issues: - CVE-2026-60137: An unauthenticated SQL injection vulnerability affecting the query parameter. - CVE-2026-6030: A REST API batch request route confusion issue, which can be combined with the SQL injection to achieve remote code execution. Exploitation Method: Attackers can leverage unauthenticated SQL injection and REST API batch request route confusion to ultimately achieve remote code execution. Affected Versions Affected Versions: - WordPress 6.9.x: Affected by both vulnerabilities; patch version is 6.9.5. - WordPress 7.0.x: Affected by both vulnerabilities; patch version is 7.0.2. - WordPress 6.8.x: Affected only by the SQL injection vulnerability; patch version is 6.8.6. - WordPress versions below 6.8: Not affected. Remediation Patch Versions: - WordPress 6.8.6 - WordPress 6.9.5 - WordPress 7.0.2 Release Date: July 17, 2026 Automatic Updates: Automatic updates have been enabled for affected versions. Wordfence Users: - Wordfence Premium, Care, and Response users received firewall protection on July 17, 2026. - Wordfence Free users received equivalent firewall protection on August 16, 2026. Key Steps 1. Verify WordPress Core Version: Ensure the website is running a patched version. 2. Update to Patched Version: Update to 6.8.6, 6.9.5, or 7.0.2 based on the current version. 3. Verify Automatic Updates: Confirm that automatic updates have completed successfully. 4. Review Admin Accounts: Check for any unexpected user accounts. 5. Review Recent Uploads and File Changes: Look for any anomalous file modifications. 6. Use the Public Checker: Use the public checker at wp2shell.com to scan the website. 7. Wordfence Users: Review firewall logs for blocked requests targeting or . Conclusion Severity: wp2shell is one of the most severe WordPress core security incidents in recent years. Global Attack Surface: The vulnerability possesses unauthenticated reachability, does not require specific plugins or themes, presents a global attack surface, provides admin access and code execution paths, and includes publicly available proof-of-concept/exploit code. Rapid Response: The WordPress Security Team rapidly released patched versions, and Wordfence Premium, Care, and Response users received firewall protection on the day of disclosure. Recommendation: Website owners should immediately update to the patched versions and review admin accounts as well as recent uploads and file changes. Additional Information Technical Details: Adam Kues's technical article provides a detailed explanation of the vulnerability chain mechanisms. Exploitation Activity: Exploitation activity was observed within hours of the patch release. Wordfence Services: If a website compromise is suspected, Wordfence Response offers 24/7/365 immediate incident response services. Code Block No specific POC code or exploit code was included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress wp2shell Unauthenticated RCE via SQLi and REST API Confusion (CVE-2026-60137/CVE-2026-6030) Advisory

More from this source