Critical WordPress Vulnerabilities Enable Remote Code Execution
Recent research conducted by Amruta Wagh from Seqrite has unveiled two significant vulnerabilities within WordPress that can be exploited to execute remote code without requiring authentication. This alarming discovery, referred to as "WP2Shell," first emerged in July 2026. The exploits combine vulnerabilities found in REST API route handling with SQL injection, allowing attackers to escalate from publicly accessible endpoints to server takeover without needing legitimate WordPress credentials.
The affected versions of WordPress include 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The implications of these vulnerabilities are profound, as they bypass the need for an account breach that is typically necessary for administrative actions, thus leading to a direct attack vector from a compromised website.
Overview of the Vulnerabilities
The first vulnerability, cataloged as CVE-2026-63030, affects the REST API batch controller at the endpoint /wp-json/batch/v1. This function allows multiple API requests to be processed together within a single JSON payload. Seqrite indicates that malicious actors can utilize nested batch structures to obfuscate route resolution, inadvertently directing requests to unintended functions that ordinarily require authentication.
It is crucial to note that this vulnerability does not execute code independently; instead, it offers an unauthenticated passage that is critical for the follow-up attack stage.
The second vulnerability, identified as CVE-2026-60137, centers around SQL injection within the posts endpoint. Specifically, the author_exclude parameter maps internally to author__not_in within WP_Query. Due to insufficient handling of input data, attackers can craft values that manipulate database queries, facilitating unauthorized access.
By weaving these two vulnerabilities together, attackers can exploit the exposed batch interface to manipulate the database effectively. The successful execution of this exploit enables the attacker to create an administrative account, subsequently allowing the deployment of a malicious plugin that may contain a web shell.
Exploit Execution Steps
The sequence of exploitation follows a multistage process rather than stemming from route confusion alone. Initial staging activities were found to involve the creation of temporary files identified as temp-write-test-* within the wp-content/ directory, which appeared to be used for testing directory writability. Following this phase, a ZIP archive, labeled wp2shell_4e9b3641.zip, was positioned in wp-content/uploads/2026/10/ for extraction purposes, ultimately leading to the placement of PHP payloads in wp-content/upgrade/wp2shell_<hex>/ before relocating the plugin directory to wp-content/plugins/wp2shell_<hex>/.
Notably, in the observed scenarios, httpd.exe facilitated these file write operations. Although legitimate activities, such as standard plugin installations, can mirror this kind of filesystem behavior, the filenames associated with WP2Shell, accompanied by unexpected PHP files and the creation of new administrator accounts, present critical clues for investigators.
Recommended Defensive Measures
In light of these vulnerabilities, it becomes imperative for cybersecurity professionals and WordPress administrators to undertake comprehensive assessments. The provided report suggests correlating evidence of suspicious activities with HTTP POST requests directed at the batch endpoint, along with careful analysis of nested API payloads. While the report primarily documents proof-of-concept scenarios and controlled laboratory conditions, it raises concerns about broader exploitation.
The version matrix indicates that WordPress versions 6.8.0 to 6.8.5 are compromised due to the SQL injection vulnerability, although the entire exploit chain does not affect them. Versions 6.8.6, 6.9.5, and 7.0.2 have been identified as containing necessary patches to rectify these issues.
Administrators are strongly urged to prioritize updates to supported versions, perform audits on administrator accounts, and scrutinize any suspicious plugin directories or unauthorized PHP modifications. Where practical, developers can mitigate exposure by restricting unauthenticated access to sensitive REST API functionalities while preparing for full remediation.
Furthermore, patching efforts should always be accompanied by a thorough assessment for signs of prior compromise, as malicious elements such as web shells or unauthorized accounts may persist even after updating vulnerable components. Failure to fully address these vulnerabilities could leave systems open to further exploitation.
By integrating proactive security measures and vigilance, website operators can maintain the integrity of their WordPress installations against such sophisticated attacks. As threats evolve, so too must the defensive strategies that shield valuable digital assets from potential intrusions.