Severity
High
Analysis Summary
A critical pre-authentication remote code execution (RCE) vulnerability, known as “wp2shell,” has been discovered in WordPress Core, potentially exposing more than 500 million websites to complete takeover by unauthenticated attackers. The flaw was identified by research team and originates from a REST API batch-route confusion vulnerability that can be chained with SQL injection to achieve remote code execution. Unlike many WordPress vulnerabilities that require vulnerable plugins, user interaction, or authenticated access, this issue can be exploited against a standard WordPress installation with no plugins installed and no login credentials required, making it highly dangerous.
The vulnerability affects specific WordPress Core versions and is tracked under CVE-2026-60137 and CVE-2026-63030. Versions 6.9.0 through 6.9.4, 7.0.0 through 7.0.1, and 7.1 beta releases are vulnerable to the RCE attack chain. The WordPress 6.8 branch is not vulnerable to the RCE component, but it is affected by a related SQL injection issue under CVE-2026-60137. To address these flaws, WordPress released version 7.0.2, along with security backports 6.9.5 and 6.8.6, fixing both the critical RCE vulnerability and the high-severity SQL injection issue.
Due to the severity and widespread impact of the vulnerability, WordPress.org implemented an unusual forced auto-update mechanism to push security patches to affected websites automatically instead of waiting for administrators to manually update. Security researchers also delayed releasing technical exploit details to prevent mass exploitation while allowing site owners time to secure their installations. A public scanning tool has been made available by Researcher through wp2shell[.]com, allowing administrators to check whether their websites are exposed.
Organizations unable to immediately apply the official patches should implement temporary mitigation measures, including blocking anonymous access to the WordPress REST API or restricting the vulnerable endpoints /wp-json/batch/v1 and ?rest_route=/batch/v1 through a Web Application Firewall (WAF). However, these workarounds may affect legitimate functionality and should only be considered temporary solutions. Given the vulnerability’s zero-authentication, no-plugin-required exploitation path and potential for full website compromise, administrators are strongly advised to prioritize immediate WordPress Core updates and verify that all affected systems have been successfully patched.
Impact
- Code Execution
- Gain Access
Indicators of Compromise
CVE
CVE-2026-60137
CVE-2026-63030
Remediation
- Update WordPress Core immediately to the latest patched versions:Upgrade to WordPress 7.0.2 or later.
- Apply backported security updates 6.9.5 or 6.8.6 for older supported branches.
- Verify that all WordPress installations are running patched versions and remove any outdated or unsupported Core releases.
- Confirm that the security update has been successfully installed.
- Use the wp2shell vulnerability scanner provided by Searchlight Cyber to identify potentially affected WordPress websites.
- If immediate patching is not possible, implement temporary mitigations:
- Block anonymous access to the WordPress REST API.
- Restrict or block the vulnerable REST API endpoints: /wp-json/batch/v1, ?rest_route=/batch/v1
- Apply WAF rules to detect and prevent suspicious requests targeting these endpoints.
- Monitor web server, application, and security logs for suspicious REST API activity, SQL injection attempts, or unauthorized administrative actions.