WP2Shell Chains WordPress REST API and SQL Injection Flaws for Unauthenticated RCE
Vulnerability Disclosure · 2 sources · Updated 16d ago · First seen Oct 16, 2026
Seqrite detailed WP2Shell, a reported WordPress Core exploit chain combining REST API route confusion (CVE-2026-63030) with SQL injection (CVE-2026-60137) to achieve remote code execution without prior authentication. In the demonstrated chain, REST API batch-route confusion exposes SQL-injection-vulnerable functionality, allowing an attacker to establish administrator access and deploy a plugin-based web shell. WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 are reportedly vulnerable to the complete chain; 6.8.0–6.8.5 is affected by the SQL injection alone. The reports describe proof-of-concept and laboratory observations, not confirmed exploitation in the wild.
Administrators should upgrade to WordPress 6.8.6, 6.9.5, 7.0.2, or a later supported release, and restrict sensitive unauthenticated REST API access where feasible. Investigations should examine unexpected administrator accounts, nested requests to /wp-json/batch/v1, temporary write-test files, staged ZIP archives, and PHP payloads in plugin directories matching wp2shell_<hex>. These artifacts can help identify potential compromise requiring remediation beyond patching.
