WP2Shell Exploit Chain: Anatomy of a Sophisticated WordPress Attack

WP2Shell is a critical WordPress Core exploit chain disclosed in July 2026 that can enables pre-authentication remote code execution (RCE) on vulnerable WordPress installations. The chain is particularly significant from a threat-intelligence perspective because it removes the requirement for an attacker to first obtain valid credentials or authenticate to the target application.

The exploitation chain leverages two WordPress Core vulnerabilities CVE-2026-63030 and CVE-2026-60137 which can be chained to transition from an unauthenticated attack condition to arbitrary code execution on affected WordPress 6.9.x and 7.0.x installations.

How the WP2Shell Attack Chain Works:

The WP2Shell attack chain combines two distinct WordPress Core vulnerabilities, using the first vulnerability to create an exploitation path for the second and ultimately achieve remote code execution.

1.      CVE-2026-63030 — REST API Route Confusion:

The first vulnerability resides in WordPress’s REST API batch-processing mechanism. A flaw in request handling can cause an incoming request to be routed or processed by an unintended REST API handler.

This route-confusion behaviour provides an attacker with the necessary primitive to reach functionality that would otherwise be difficult to invoke directly.

2.      CVE-2026-60137 — SQL Injection:

The second vulnerability is a SQL injection flaw associated with the author__not in parameter in WP_Query. In isolation, the vulnerability primarily affects the database query layer, allowing attacker-controlled input to influence SQL queries.

On its own, this issue does not necessarily provide direct code execution. Its significance becomes much greater when combined with the REST API vulnerability.

3.      Chaining the Vulnerabilities:

The core of WP2Shell lies in the interaction between these two vulnerabilities. CVE-2026-63030 provides the attack path needed to reach and exploit the SQL injection in CVE-2026-60137.

4.      Achieving Remote Code Execution:

The combined exploitation chain can ultimately be leveraged to achieve remote code execution (RCE) on the affected WordPress server. Successful exploitation can therefore move an attacker from an externally accessible application-level entry point to execution of attacker-controlled code on the underlying system.

Why “Pre-Authentication” Matters:

Pre-authentication means that an attacker does not need a valid WordPress account, credentials, or an authenticated session before attempting to exploit the vulnerability.

This significantly lowers the barrier to exploitation. In a traditional attack scenario, an adversary might first need to compromise an administrator account before exploiting a vulnerable WordPress component:

Compromise administrator account → Authenticate → Exploit WordPress

With WP2Shell, the attack path can instead begin directly from the publicly exposed WordPress application:

Reach public WordPress site → Exploit vulnerable Core components → Execute attacker-controlled code

Because the exploitation chain can be initiated without prior authentication, an exposed and vulnerable WordPress installation may be directly reachable by an unauthenticated attacker, increasing the potential attack surface and urgency of remediation

WP2Shell Vulnerability Details:

CVE-2026-63030 — REST API Route Confusion:

CVE-2026-63030 affects the WordPress REST API batch-processing mechanism exposed through the /wp-json/batch/v1 endpoint. The batch controller allows clients to submit multiple REST API requests within a single JSON payload.

The vulnerability stems from how the batch controller resolves and dispatches nested routes. By embedding an inner batch structure within an outer batch request, an unauthenticated attacker can manipulate the route-resolution process and reach REST API handlers that would normally require authentication.

On its own, CVE-2026-63030 does not provide direct code execution. Its importance in the WP2Shell chain is that it provides an unauthenticated path to functionality vulnerable to CVE-2026-60137.

CVE-2026-60137 — SQL Injection:

CVE-2026-60137 is an SQL injection vulnerability associated with the WordPress REST API’s posts endpoint. The public-facing author_exclude parameter is mapped internally to the author__not_in argument used by WP_Query.

Due to insufficient input handling, specially crafted values supplied through author_exclude can influence the resulting database query and potentially introduce attacker-controlled SQL.

While the SQL injection represents a database-level vulnerability on its own, its impact becomes significantly more serious when combined with CVE-2026-63030.

In other words, CVE-2026-63030 provides the unauthenticated route to the affected functionality, while CVE-2026-60137 provides the SQL injection primitive. Chaining these weaknesses transforms two separate vulnerabilities into a broader exploitation path that can ultimately lead to remote code execution

Exploitation Behaviour:

1. Unexpected WordPress administrator accounts may be created as part of the attack chain. The proof-of-concept demonstrates how the batch-based SQL injection can be leveraged to establish an administrator-level foothold.

Following privilege escalation, the attack chain proceeds to the deployment of a plugin-based web shell, which provides an interface for executing commands on the compromised WordPress server.

2.      Captured Exploitation Payload

A captured HTTP POST request targets the WordPress REST API batch endpoint at /wp-json/batch/v1. The request body contains nested API requests that trigger the route-confusion vulnerability and subsequently reach the vulnerable query functionality.

WP2Shell Staging Activity:

1. Writability Checks: The exploitation process creates and subsequently removes temporary files matching the temp-write-test-* pattern under wp-content/. This activity appears intended to verify that the target directory is writable.

2. Payload Staging: A ZIP archive is written to the WordPress uploads directory under wp-                   content/uploads/2026/10/, with filenames such as wp2shell_4e9b3641.zip.

3. Payload Extraction: The staged archive is unpacked, resulting in PHP files being written beneath wp-content/upgrade/wp2shell_<hex>/, including files such as wp2shell_<hex>.php.

4. Install: The plugin directory is renamed into wp-content/plugins/wp2shell_<hex>/ making the payload available within the WordPress plugin director.

All of this is httpd.exe the process performing the file writes, which is expected during legitimate WordPress plugin uploads. However, the unusual volume and WP2Shell-specific filenames make this activity suspicious on a system.

WP2Shell Host Artifacts:

• Plugin directories: Directories matching the wp2shell_<hex> naming pattern under wp-content/plugins/.
• PHP file activity: Newly created or modified .php files within wp-content/plugins/ or wp-content/cache/.
• Write-test artifacts: Temporary files matching the temp-write-test-* pattern under wp-content/, observed during lab testing and staging activity.
• Unexpected administrator accounts: Newly created WordPress administrator accounts appearing during the suspected exploitation window.

Which WordPress Versions Were Affected?

WordPress Version	Status
6.8.0–6.8.5	Affected by CVE-2026-60137
6.9.0–6.9.4	Vulnerable to the full WP2Shell RCE chain
7.0.0–7.0.1	Vulnerable to the full WP2Shell RCE chain
6.8.6	Fixed
6.9.5	Fixed
7.0.2	Fixed

 

WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 were exposed to the complete WP2Shell exploitation chain.

MITER ATT&CK Mapping:

Tactic	Technique	Evidence
Active Scanning: Vulnerability Scanning	T1595.002	Scanning for exposed WordPress endpoints, including /wp-json/ and the batch API endpoint.
Exploit Public-Facing Application	T1190	Exploitation of the batch route-confusion vulnerability, followed by SQL injection through the author_exclude parameter.

Recommendations:

1. Prioritize patching and remediation. Upgrade affected WordPress installations to 6.8.6, 6.9.5, 7.0.2, or a later supported release as appropriate.

1. Limit unauthenticated REST API exposure. Where operationally feasible, restrict unauthenticated access to sensitive WordPress REST API functionality, with particular attention to the batch controller and posts queries that expose author-filtering functionality.

1. Hunt for post-exploitation indicators. Inspect affected WordPress hosts for unexpected PHP files, recently created or modified application files, suspicious plugin directories, anomalous administrator accounts, and other filesystem or application-level changes occurring during the suspected exploitation window.

How Does Quick Heal Protect Its Customers?

Quick Heal leverages its existing advanced protection technologies to safeguard customers against the WP2Shell exploit.

The following behavioural and network-based detections help identify and protect against WP2Shell attack activity.

Behavioural Detection:

• SL_A WP2Shell Suspicious PHP File Modification in WordPress Plugins : Detects suspicious PHP file creation or modification within WordPress plugin directories.

Network-Based Detections:

• HTTP/CVE-2026-63030!DP.50405
• HTTP/CVE-2026-63030!SP.50370

These layered detection capabilities help identify suspicious activities associated with WP2Shell and strengthen protection against potential exploitation attempts.

Authors: Amruta Wagh and Yash Jare