CVE-2026-63030 & CVE-2026-60137: WordPress Core Pre-Authentication RCE Overview & Takeaways
WordPress has disclosed a critical vulnerability chain nicknamed “wp2shell,” consisting of CVE-2026-63030 (REST API Route Confusion) and CVE-2026-60137 (SQL Injection). CVE-2026-63030 affects WordPress Core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. CVE-2026-60137 affects the same versions as well as the earlier versions 6.8.0 through 6.8.5. When CVE-2026-63030 (REST API Route Confusion) is chained with CVE-2026-60137, it results in an unauthenticated SQL injection that grants complete control of an affected WordPress site, including access to all data, the ability to install malicious code, and full administrative access. Attackers are actively exploiting these vulnerabilities in the wild. WordPress is automatically pushing the fix, but don’t assume it worked. Check that your sites are running the patched version right away.
What do I need to know?
CVE-2026-63030 — REST API Batch Endpoint Route Confusion
| Severity | 9.8 (Critical) — CVSS v3.1, per WPScan (CNA); NVD score pending |
| Attack Vector | Network — unauthenticated, no user interaction required |
| Root Cause | CWE-436: Interpretation Conflict |
| Impacted Products | WordPress Core 6.9.0–6.9.4 • WordPress Core 7.0.0–7.0.1 |
| Potential Impact | Enables unauthenticated access to CVE-2026-60137 SQL injection → full RCE • Webshell deployment, data exfiltration, persistent backdoor, site defacement |
CVE-2026-60137 — WP_Query SQL Injection
| Severity | 9.1 (Critical) — CVSS v3.1, per CISA-ADP |
| Attack Vector | Network — unauthenticated when chained with CVE-2026-63030 |
| Root Cause | CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) |
| Impacted Products | WordPress Core 6.8.0–6.8.5 (SQL injection only; RCE chain requires 6.9+) • WordPress Core 6.9.0–6.9.4 • WordPress Core 7.0.0–7.0.1 |
| Potential Impact | Unauthorized database read, including admin password hashes • Full RCE when chained with CVE-2026-63030 on 6.9.x / 7.0.x |
| Exploitation | Active exploitation confirmed. Public PoCs available July 17, 2026. Widespread scanning reported by watchTowr and Searchlight Cyber beginning July 18, 2026. |
What do I need to do?
We recommend the following steps to identify and remediate this vulnerability:
Review and Audit
- Identify every WordPress instance across your environment, including staging and development sites, and verify the version each one is running. Do not assume forced auto-update has applied; verify directly via WP-CLI (wp core version) or Dashboard → At a Glance.
- Flag any instance running 6.9.0–6.9.4 or 7.0.0–7.0.1 as immediately vulnerable to the full unauthenticated RCE chain. Flag 6.8.0–6.8.5 as vulnerable to the SQL injection in isolation.
- Review logs for POST requests to /wp-json/batch/v1 or /?rest_route=/batch/v1 with nested request arrays or SQL-like strings (SELECT, IF, SLEEP) in author_exclude / author__not_in parameters. Run wp core verify-checksums on any unpatched instance and investigate mismatches.
- No official IOCs have been published. Check for new/unrecognized admin accounts, unexpected PHP files in wp-content/uploads or wp-content/plugins, and injected redirects or JavaScript.
Patch Immediately
- 7.0.x: Update to 7.0.2 — Release Notes
- 6.9.x: Update to 6.9.5
- 6.8.x: Update to 6.8.6 (addresses CVE-2026-60137 SQL injection; no RCE exposure on this branch)
Mitigation (If Patching Is Delayed)
- Block both batch API paths at your WAF: /wp-json/batch/v1 and /?rest_route=/batch/v1. Note that blocking only one leaves the alternate route open.
- Consider installing a plugin that fully restricts anonymous access to REST APIs.
- Cloudflare managed WAF rules for both CVEs are active across all plans (including free) for proxied sites as of July 17, 2026. The Wordfence (Premium/Care/Response) firewall rule was also released July 17, 2026.
- Treat any internet-facing 6.8.x, 6.9.x or 7.0.x instance as potentially compromised until patched and integrity-verified.
NetSPI Product and Services Coverage
NetSPI’s External Attack Surface Management has released a detection for these CVEs. The current detection name is:
Vulnerable Version – WordPress SQL Injection (CVE-2026-60137) / Vulnerable Version – WordPress REST API Route Confusion (CVE-2026-63030)
NetSPI’s Penetration Testing Services can also help identify exposure to these vulnerabilities.
ADDITIONAL RESOURCES
Explore More Blog Posts
ADPathFinder: OpenGraph Attack Path Mapping in BloodHound CE
ADPathFinder unifies SharpHound data with OpenGraph collectors like MSSQLHound and ConfigManBearPig. Discover how this tool maps complex, cross-dataset privilege escalation paths across AD, ADCS, MSSQL, and SCCM, and brings vital graph context to your password audits.
Confidence Over Noise: Introducing Continuous AI Findings Validation
NetSPI's Continuous AI Findings Validation service applies expert human judgment to AI-generated security findings, eliminating false positives and verifying severity so security teams can trust, prioritize, and act with confidence instead of chasing noise.
Bypassing Microsoft Entra Conditional Access Policies via Nested App Authentication
Discover how attackers bypassed Microsoft Entra Conditional Access Policies using Nested App Authentication (NAA) flows in this technical vulnerability breakdown.