Overview
- Researchers at Searchlight Cyber disclosed a chained pre-authentication remote code execution called wp2shell that lets an anonymous HTTP request run code on default WordPress installs.
- The chain uses a REST API batch-route confusion bug introduced in WordPress 6.9 (CVE-2026-63030) together with an SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137) to achieve RCE.
- WordPress released security updates 6.9.5 and 7.0.2 on July 17 to fix the chain and enabled forced automatic security updates for supported installs, but it is unclear whether sites with auto-updates turned off received the patch.
- Public proof-of-concept exploits appeared within days and multiple security firms have reported in-the-wild exploitation, so administrators should update immediately or apply temporary mitigations.
- Temporary mitigations include applying vendor WAF rules or blocking /wp-json/batch/v1 and ?rest_route=/batch/v1, using Searchlight’s wp2shell.com checker to test instances, and prioritizing full updates to avoid site takeover and downstream compromises.