By July 21, 2026, security teams were seeing a flood of activity around the WordPress wp2shell exploit, a two‑vulnerability chain that lets an anonymous attacker take over a stock WordPress install with a single HTTP request. That’s the catch.
Key Takeaways
- Two CVEs—CVE-2026-63030 and CVE-2026-60137—combine to give unauthenticated remote code execution.
- Public PoC code triggered mass scanning across at least seven countries.
- AI‑assisted analysis lowered the barrier to weaponizing the flaws.
- Wiz reports 60% of WordPress‑using organizations initially had vulnerable instances; 25% exposed them to the Internet.
- Over tens of thousands of exploitation attempts have hit honeypots worldwide.
Historical Context
The wp2shell chain didn’t appear in a vacuum. WordPress has long been a favorite target for attackers because of its massive market share and its extensible architecture. Since the platform’s early days, the community has responded to vulnerabilities with rapid patch cycles, and the 2026 disclosures follow that tradition. When the two CVEs were assigned in mid‑2026, the vendor issued patches within days, underscoring a reactive but efficient process.
What makes this episode distinct is the convergence of two independent bugs into a single, exploitable path. Earlier incidents often required a pre‑existing plugin or a misconfiguration to succeed. Here, the chain works on a clean install—no extra code, no prior foothold. That shift reflects a broader trend: attackers increasingly look for “stock” attack surfaces that minimize the noise they generate.
Another factor is the timing of AI tooling. The same month the CVEs were disclosed, OpenAI released GPT‑5.6, a model capable of parsing vulnerability descriptions and generating functional exploit code. The rapid adoption of that model in both red‑team and blue‑team circles accelerated the weaponization timeline. In prior years, a similar chain might have taken weeks to mature; this time it was a matter of hours.
What the wp2shell Chain Actually Does
Searchlight Cyber spent just over ten hours using OpenAI GPT‑5.6 Sol to stitch together the exploit chain. The result lets an attacker bypass authentication, inject malicious SQL, and then spin up a PHP web shell that runs arbitrary code. The chain works on any WordPress version released since December 2025, provided the persistent object cache isn’t enabled.
Ben Marr of Intruder broke it down: “this exploit uses a two‑part vulnerability chain to achieve unauthenticated SQL injection on a stock WordPress installation with a single HTTP request.” He added that the entry point, CVE‑2026‑60137, is a route‑confusion bug in the REST API batch endpoint that lets attackers invoke internal handlers without any permission check.
How the Two CVEs Interact
CVE‑2026‑60137, present from WordPress 6.8 onward, mishandles the author__not_in parameter inside WP_Query. When untrusted data reaches that parameter—often via a theme or plugin—it alters the underlying SQL query. That opens the door for a classic SQL injection, which can be blind, UNION‑based, or Boolean‑based, as Ryan Dewhurst of KEVIntel observed.
Once the injection succeeds, CVE‑2026‑63030—visible in versions 6.9 and later—lets the attacker execute code remotely, but only if the site isn’t using a persistent object cache. The combination is lethal because it requires no pre‑installed plugins or prior access.
Technical Architecture of the Exploit
At the core of the chain lies WordPress’s REST API batch handler. The vulnerable endpoint expects a well‑formed JSON payload that references internal functions. Because the permission check is omitted, an attacker can craft a request that triggers WP_Query with a malicious author__not_in value. The malformed value is then concatenated into a raw SQL string, bypassing the sanitization layer.
The subsequent SQL injection grants the attacker the ability to write arbitrary data into the database. By targeting the options table, the exploit can inject PHP code that will be interpreted on the next page load. This is where the persistent object cache decision matters: when the cache is active, WordPress reads configuration from memory instead of hitting the database, effectively short‑circuiting the injected code path.
After the malicious PHP snippet is stored, the attacker issues a follow‑up request that loads the newly created file as a plugin. The plugin’s entry point is a minimal web shell—about 150 KB in size—that provides a command‑execution interface. Because the shell masquerades as a legitimate security plugin, it can evade basic file‑integrity checks.
All of these moves happen within a single HTTP transaction for the initial injection, and a second lightweight request to activate the shell. The attacker never needs to upload a large payload; the server does the heavy lifting. That efficiency explains why the PoC spread so quickly across multiple continents.
Scale of the Attack: From Sensors to Global Scanning
Telemetry from KEVIntel identified 13 unique IP addresses spanning Switzerland, Germany, the U.K. Indonesia, Lithuania, the Netherlands, and Singapore that were linked to exploitation of CVE‑2026‑63030. That’s a modest set, but the pattern quickly broadened.
WatchTowr’s honeypots reported “tens of thousands of exploitation attempts” after the public PoC dropped. Jake Knott, principal security researcher at watchTowr, warned that “by the early hours of Saturday morning (UTC), successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public.”
Ryan Dewhurst said the campaign shifted from probing WordPress‑specific sensors to indiscriminate Internet‑wide scanning, with requests matching the publicly released PoC. “Attackers used multiple SQL injection techniques, including blind, UNION‑based and Boolean‑based payloads,” he told The Hacker News.
Geographic Reach and Bot Behavior
The spread across seven countries hints at a loosely coordinated botnet rather than a single actor. The activity mirrors legitimate security scans, which makes detection harder. Wiz researchers Shahar Dorfman and Gili Tikochinski noted, “We’ve also observed high‑volume scanning activity without subsequent post‑exploitation, suggesting opportunistic mass‑scanning campaigns seeking to identify vulnerable targets alongside legitimate security scanning activity.”
Post‑Exploitation Playbook
Once inside, attackers follow a fairly predictable sequence:
- Upload a malicious plugin.
- Enumerate users and harvest admin usernames and email addresses.
- Launch local file inclusion attacks to steal database credentials and authentication keys.
- Access the admin panel and authenticate as an admin.
- Drop a bare‑bones PHP web shell that enables remote code execution.
Wiz observed a particularly nasty 150 KB web shell masquerading as the legitimate WordPress security plugin CMSmap. The shell acts as a “full‑featured attack platform” with file management, database access, port scanning, batch code injection, and even MySQL UDF exploitation modules.
Why AI Made This Chain So Easy to Weaponize
Ryan Dewhurst credited AI‑assisted analysis for making PoC development “trivial.” The claim underscores how generative models can accelerate vulnerability research, turning a complex chain into a few lines of code once the details are public.
That acceleration is a double‑edged sword. While defenders can use the same tools to hunt for abuse, attackers can also iterate faster, spreading exploits before patches are widely applied.
Defensive Recommendations
Organizations should treat the two CVEs as a single critical issue. Immediate steps include:
- Apply the official patches for both CVEs across all WordPress installations.
- Enable persistent object caching to block the RCE path of CVE‑2026‑63030.
- Audit REST API endpoints for unexpected traffic and enforce strict authentication.
- Monitor for the presence of the 150 KB CMSmap‑style web shell.
- Rotate compromised credentials and audit admin accounts for unauthorized backdoors.
Because the exploit works on a clean WordPress install, even sites that haven’t added third‑party plugins aren’t safe. That’s why the threat vector is so alarming.
What This Means For You
If you run a WordPress site—whether for a blog, e‑commerce store, or internal portal—you’re likely sitting on an unpatched instance. The reality is that the vulnerability chain doesn’t need any custom code; it can be triggered with a single request. That means you should prioritize patching above any feature development.
Developers should also consider integrating automated scanning for the specific REST API batch endpoint pattern described by Ben Marr. Adding a simple rule to your CI/CD pipeline can flag any unexpected calls to that endpoint before code reaches production.
For security teams, the takeaway is to treat the surge in scanning as a warning sign. High‑volume requests that match the PoC may not result in immediate compromise, but they’re a clear indicator that threat actors are probing for the easiest foothold.
Going forward, the question isn’t whether WordPress will be targeted again—it’s how quickly we can close the gap between vulnerability disclosure and widespread patching.
Concrete Scenarios
Scenario 1: A small business uses a managed WordPress host that automatically applies minor updates but skips major releases. The host’s update schedule lags behind the CVE disclosures, leaving the site exposed for weeks. In this case, an immediate manual patch or a temporary block on the vulnerable REST endpoint buys critical time.
Scenario 2: An enterprise runs an internal knowledge‑base on WordPress 6.9 without a persistent object cache to reduce memory usage. Because the cache is disabled, the RCE path is fully open. Enabling the cache or adding a WAF rule that drops malformed author__not_in parameters mitigates the risk without disrupting internal workflows.
Scenario 3: A freelance developer builds a custom theme that inadvertently passes user‑supplied data to WP_Query. Even though the theme is freshly deployed, the chain can be triggered. Adding server‑side validation that sanitizes the author__not_in field eliminates the injection vector at the source.
Key Questions Remaining
- Will future AI models further compress the time from disclosure to exploitation, making “zero‑day” windows effectively nonexistent?
- Can the WordPress core team introduce a permanent, low‑overhead mitigation for the REST API batch endpoint without breaking existing integrations?
- How will hosting providers balance automatic patching with the need to maintain site stability, especially for legacy installations?
Answers to these questions will shape the next wave of defensive strategies. The community must collaborate, share indicators of compromise, and adopt a proactive stance.
“By the early hours of Saturday morning (UTC), successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public,” Jake Knott told The Hacker News.
As AI tools keep lowering the barrier to weaponization, the security community will need to adapt faster than the attackers. The wp2shell saga is a stark reminder that the ecosystem’s biggest assets—its openness and extensibility—can also be its Achilles’ heel.
Sources: The Hacker News, Wiz
