WordPress Core wp2shell Pre-Authentication RCE Exploit Chain

A critical exploit chain dubbed 'wp2shell,' comprising CVE-2026-63030 and CVE-2026-60137, has been identified in WordPress Core. Unlike most WordPress vulnerabilities that reside in third-party plugins, this flaw exists in the base application and can be exploited by unauthenticated attackers against stock installations with no special configuration. The vulnerability allows an anonymous user to escalate privileges, create a rogue administrator account, and ultimately execute arbitrary code on the underlying web server.

The attack utilizes a route-confusion bug in the WordPress REST API batch endpoint to bypass permission checks. This leads to a second vulnerability in WP_Query where unsanitized input enables SQL injection. By manipulating database objects through object hydration and oEmbed caching, attackers can forge administrator credentials. Active exploitation has been observed in the wild, with attackers deploying webshells and creating rogue users.

Security teams must prioritize updating WordPress to versions 6.9.5, 7.0.2, or later. Organizations unable to patch immediately should implement WAF rules to block the batch API endpoint and monitor for artifacts such as unexpected administrator accounts and unauthorized PHP files in the WordPress content directories.