Breaking: WordPress wp2shell mass exploitation underway — 22 July 2026
WordPress wp2shell: Mass Exploitation Underway After PoC Release
Two WordPress Core vulnerabilities tracked as CVE-2026-63030 (CVSS 9.8) and CVE-2026-60137 (CVSS 5.9) are being chained under the name "wp2shell" to achieve unauthenticated remote code execution on default WordPress installations. CISA added both to the Known Exploited Vulnerabilities catalog on July 21. The situation has escalated rapidly over the past 24 hours.
CVE-2026-63030 is a logic flaw in the WordPress REST API batch endpoint (/wp-json/batch/v1). The batch processor validates and executes in separate loops; when wp_parse_url() fails on a sub-request, the error is pushed to the validation array but not the matches array, desynchronising them and causing every subsequent request to dispatch under the wrong handler. This lets an unauthenticated attacker reach internal API endpoints that normally require authentication.
CVE-2026-60137 is a SQL injection in the author__not_in parameter of WP_Query. The parameter is interpolated directly into raw SQL when provided as a scalar string. On its own, parameter validation prevents exploitation, but the batch API desynchronisation bypass removes that guard, yielding pre-authentication UNION-based SQL injection.
When chained, the two flaws enable an attacker to create an administrator account via SQL injection, log in, and upload a malicious plugin for full code execution. No plugins, no special configuration, no user interaction required. WordPress versions 6.8.0 through 7.0.1 are affected. Fixes shipped in 6.8.6, 6.9.5, and 7.0.2 on July 17.
Wiz Research has confirmed active exploitation in cloud environments. Post-exploitation activity includes malicious plugin uploads (persistent webshells), user enumeration, local file inclusion targeting wp-config.php for database credentials, and successful admin panel access. Two webshell variants have been identified: a minimal one-liner returning 404 as evasion, and a 150KB full-featured attack platform disguised as a WordPress plugin called "CMSmap" with file management, database access, port scanning, and privilege escalation modules. A third variant registers a custom REST API endpoint to accept base64-encoded commands. At least 13 attacker IPs are involved, with activity shifting from targeted probing to broad internet-wide scanning.
Field Effect reports that public PoC code appeared within hours of disclosure. Multiple repositories now host working exploits and automated scanners. Cloudflare data indicates the vulnerable code path is reachable when a persistent object cache is not in use, which covers most default WordPress installations.
So what / Action: Patch WordPress immediately to 6.8.6, 6.9.5, or 7.0.2 and verify automatic updates completed. Where immediate patching is not possible, block the /wp-json/batch/v1 and ?rest_route=/batch/v1 endpoints at the WAF or disable anonymous REST API access. After patching, hunt for indicators of compromise: HTTP 207/200 responses to batch endpoint requests, user agents containing "wp2shell" or "rezwp2shell", unexpected PHP files in content and cache directories, unfamiliar plugins, and unauthorised administrator accounts. Regenerate credentials and authentication salts on any site that was exposed. This is not a wait-and-see situation. The attack surface is enormous (WordPress powers 43% of the web) and weaponised exploit code is freely available.