A critical pre-authentication remote code execution vulnerability chain known as WP2SHELL has been discovered in WordPress Core, affecting millions of websites. Learn the mechanics of the REST API route confusion and SQL injection, and access concrete detection logic and remediation guidance.
Critical pre-authentication remote code execution vulnerability chain in WordPress Core.
Unauthenticated client POSTs structured sub-requests to /wp-json/batch/v1
Malformed initial sub-request triggers validation failure, shifting permissions mapping (CVE-2026-63030)
Bypassed batch router directs nested query payload directly into WP_Query database layer
Malformed string in author__not_in bypasses sanitization (CVE-2026-60137)
Attacker exfiltrates admin hashes, logs in, and uploads malicious PHP webshell backdoor
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
A threat actor is auctioning a zero-day exploit targeting an undisclosed WordPress plugin with over 10,000 active installations. The vulnerability allows low-privileged users with the create_users capability to escalate to Administrator, leading to full site takeover. Discover detection and containment strategies.
June 19, 2026
A reported zero-day exploit targeting Local Privilege Escalation (LPE) in Windows presents a significant risk to enterprise security, potentially allowing attackers to elevate permissions and compromise system integrity.
June 21, 2026
A threat actor is reportedly offering a malware framework exploiting vulnerabilities in libsodium and NaCl. We analyze the risks to enterprise cryptographic integrity and provide mitigation steps.
Validating exposure and enforcing immediate patch controls must be the first priority for security teams protecting WordPress environments against the critical WP2SHELL pre-authentication remote code execution vulnerability chain.
Discovered by the security research team at Femto Security, this critical vulnerability chain requires absolutely no active plugins, theme modifications, or authenticated sessions to execute. A stock, default installation of WordPress is vulnerable to complete remote takeover by an anonymous user. With WordPress powering over 40 percent of the web, estimated at over 500 million websites, the exposure vector is massive, prompting emergency responses from security administrators globally.
Shortly after the public disclosure of WP2SHELL, cybercrime networks and automated scanning ecosystems integrated the exploit chain. Mass-exploitation groups, particularly Webshell Access Brokerages, actively scan the internet to compromise vulnerable WordPress instances. These groups establish persistent backdoors and sell access to ransomware syndicates or initial access brokers.
One specific campaign associated with this threat is known as WP-SHELLSTORM. This automated operation uses distributed scanning infrastructure, including malicious IP addresses such as 137.175.93.126, to target vulnerable CMS systems globally. The malicious activity maps directly to several key techniques within the MITRE ATT&CK framework:
T1190: Exploit Public-Facing Application, represented by targeting the vulnerable batch API route and SQL injection parameters.
T1068: Exploitation for Privilege Escalation, achieved via the REST API batch-route permission bypass.
T1565.001: Stored Data Manipulation, occurred when attackers alter user privileges or database tables via SQL injection.
T1505.003: Server Software Component: Web Shell, utilized to maintain persistent administrative access post-compromise.
T1059.008: Command and Scripting Interpreter, used when executing system commands via the uploaded PHP backdoor.
In environments where automated background updates are enabled, verify that the updates were applied successfully. If immediate patching is not possible due to legacy system dependencies, implement temporary emergency mitigations. These include installing a security plugin that completely disables anonymous access to the REST API, or blocking access to the batch endpoints using WAF rules. Keep in mind that these temporary blocks may disrupt legitimate site features, such as external integration tools and administrative dashboards.
If you discover an unpatched instance exposed to the internet, execute a comprehensive compromise assessment protocol immediately. Verify active administrative user accounts for unauthorized profiles, inspect the file system for newly modified or uploaded PHP files, review the database for injected scripts, and rotate all administrative passwords, database credentials, and secret salts. For systematic identification of vulnerabilities across your digital assets, explore our Vulnerability Management assessments to safeguard your organization against emerging threats.
To secure your systems, understanding your external perimeter and identifying all deployed WordPress instances is crucial. Our team can help catalog and continuously scan your external environment. Explore our Attack Surface Management services to learn how we continuously discover and monitor all your internet-facing assets for severe exposures.
Free exposure check
Dark Web Scanner
check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain.
The WP2SHELL threat is not a single bug, but rather an elegant and highly destructive vulnerability chain. It combines a REST API route and validation desynchronization vulnerability, tracked as CVE-2026-63030, with a core SQL injection vulnerability, tracked as CVE-2026-60137, in the main WordPress query engine class. The exploit bypasses authentication barriers and manipulates SQL queries, culminating in remote code execution on the host operating system.
The WordPress REST API batch endpoint, located at /wp-json/batch/v1, is designed to handle multiple nested sub-requests inside a single HTTP request. This optimization improves performance for dashboard interactions and mobile apps. However, a severe logical flaw exists in the batch dispatcher framework.
When parsing incoming nested sub-requests, the dispatcher evaluates them sequentially. An attacker can craft a payload where the very first sub-request is designed to fail validation immediately, such as by passing an invalid target path like http://:. When this validation failure occurs, the dispatcher generates a WP_Error object. Due to an implementation error, this failed request is excluded from the internal match array but retained in the main dispatcher index. This mismatch creates an off-by-one array offset desynchronization.
Consequently, subsequent sub-requests in the batch queue are evaluated against the dispatch and permission callbacks of the previous sub-request. This logical flaw allows an unauthenticated attacker to completely bypass route-level access restrictions and execute actions reserved for authenticated administrative sessions.
Once the route restrictions are bypassed, the attacker dispatches a nested sub-request directly to the core query engine, specifically targeting the WP_Query class. This query engine handles database searches and post fetching. The vulnerability lies within the processing of the author__not_in parameter, which is designed to exclude specific author IDs from query results.
Normally, this parameter expects an array of integer values. However, if an attacker passes a raw string instead of an array, the core type check functions are bypassed. The database abstraction layer fails to sanitize the input properly when a string is received in this specific context, dropping the raw, attacker-controlled string directly into the SQL query string. This results in an unauthenticated, blind, or time-based SQL injection vulnerability.
Through the SQL injection vector, attackers can execute commands to retrieve sensitive data from the database. This includes extracting administrator session hashes, database credentials, and altering tables. After acquiring these credentials, the attacker logs in as an administrator and uploads a malicious theme or plugin containing a PHP-based backdoor, commonly known as a webshell. This backdoor allows the attacker to execute arbitrary shell commands on the underlying web server, resulting in a full system compromise.
This remote code execution chain is highly reliable on default WordPress configurations, especially where a persistent object cache like Redis or Memcached is not utilized to abstract database interactions.
Security engineers can safely test their websites to determine if the routing engine exhibits the off-by-one desynchronization behavior. The following safe proof-of-concept probe simulates the validation mismatch without executing malicious database commands.
POST /?rest_route=/batch/v1 HTTP/2.0
Host: target-website.com
Content-Type: application/json
{
"validation": "normal",
"requests": [
{"method": "POST", "path": "http://:"},
{"method": "DELETE", "path": "/wp/v2/categories/0"},
{"method": "POST", "path": "/wp/v2/block-renderer/core/paragraph"}
]
}If the response indicates that the routing engine attempted to process the restricted DELETE or POST commands without returning standard authorization errors, the WordPress core is vulnerable to route desynchronization. In addition to validation, active monitoring at the network layer is essential to detect ongoing exploitation attempts.
To block or alert on incoming exploit attempts, security teams can implement rules targeting unauthenticated access to the batch routes. The following ModSecurity-compatible rules identify and block the typical batch request structures:
# Block REST API Batch Endpoint accesses from unauthenticated sources
SecRule REQUEST_URI "@contains /wp-json/batch/v1" \
"id:2026101,phase:2,deny,status:403,msg:'WP2SHELL REST API Batch Exploit Blocked'"
# Block alternative Query String Route format
SecRule ARGS:rest_route "@contains /batch/v1" \
"id:2026102,phase:2,deny,status:403,msg:'WP2SHELL REST Query Batch Exploit Blocked'"Security Operations Centers can use log search queries to hunt for historical exploitation attempts or unauthorized scanning. The following query helps identify traffic directed to the vulnerable batch endpoints:
(uri_path="/wp-json/batch/v1" OR uri_query="*rest_route=/batch/v1*") AND method="POST"Analysts should inspect the payloads of matching requests for nested structures containing abnormal paths or string inputs assigned to variables like author__not_in.
The most effective method to mitigate the WP2SHELL vulnerability chain is to update WordPress Core immediately. The WordPress Security Team has released updates to address both core vulnerabilities. Organizations must verify that their instances run the correct secured versions:
If your organization utilizes the 7.0 branch, update to version 7.0.2 immediately.
If your organization utilizes the 6.9 branch, update to version 6.9.5 immediately.
If running legacy 6.8 installations, update to version 6.8.6 to eliminate the core SQL injection vulnerability.