wp2shell WordPress Core Remote Code Execution Chain

On July 17, 2026, a critical exploit chain named 'wp2shell' was disclosed affecting WordPress Core versions 6.9.0-6.9.4 and 7.0.0-7.0.1. The chain combines a REST API batch-route confusion weakness (CVE-2026-63030) with a SQL injection flaw in the author__not_in parameter (CVE-2026-60137). Within hours of disclosure, multiple proof-of-concept (PoC) exploits were released on GitHub, and security firms confirmed active in-the-wild exploitation.

The technical chain allows an unauthenticated attacker to bypass parameter sanitization by desynchronizing request handlers. This enables a SQL injection that can be used to forge post objects, seed oEmbed caches, and eventually create a new administrator account. Once administrative access is gained, attackers typically upload a malicious plugin to execute commands. WordPress has released patches in versions 7.0.2 and 6.9.5, and has enabled forced automatic updates for supported installations.