WordPress Patches `wp2shell` Bug Chain Enabling Unauthenticated RCE

WordPress released security updates for two core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, that can be chained to make a blind SQL injection remotely reachable without authentication and, in some cases, lead to remote code execution. The issue, dubbed wp2shell, stems from REST API batch-route confusion in the /wp-json/batch/v1 endpoint combined with SQL injection, affecting WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Researchers said the route-confusion flaw carries a CVSS 9.8 rating, while the second SQL injection bug is rated CVSS 5.9.

WordPress fixed the flaws in 6.9.5 and 7.0.2, and also backported the SQL injection fix to 6.8.6. The vulnerabilities were reported by Adam Kues of Assetnote through the WordPress HackerOne program, and while exploitation had not been confirmed at the time of disclosure, a public proof of concept later became available, increasing the risk of rapid weaponization. Administrators were urged to verify that forced automatic updates succeeded and, if immediate patching was not possible, to apply mitigations such as blocking the REST batch endpoint with a WAF.