Executive Summary
In July 2026, two critical vulnerabilities, CVE-2026-63030 and CVE-2026-60137, were discovered in WordPress Core versions 6.8.0 through 7.0.1. These flaws, collectively termed "wp2shell," allow unauthenticated attackers to execute remote code by exploiting a REST API route confusion and an SQL injection vulnerability. The exploitation enables full control over affected WordPress sites, including data access, malicious code installation, and administrative privileges. (threatprotect.qualys.com)
The widespread use of WordPress, powering over 500 million websites, amplifies the impact of these vulnerabilities. (threatprotect.qualys.com) Public proof-of-concept exploits have been released, and active exploitation has been observed in the wild, underscoring the urgency for immediate remediation.
Why This Matters Now
The "wp2shell" vulnerabilities pose a significant threat due to their ease of exploitation and the extensive use of WordPress globally. Immediate patching is crucial to prevent unauthorized access and potential widespread compromise of websites.
Attack Path Analysis
An unauthenticated attacker exploited a REST API route confusion vulnerability (CVE-2026-63030) to send crafted requests, leading to SQL injection (CVE-2026-60137) that granted administrative access. The attacker escalated privileges by injecting SQL commands to create a new admin user. They then moved laterally within the WordPress environment to access sensitive data and install malicious plugins. A reverse shell was established for command and control, allowing remote execution of commands. The attacker exfiltrated sensitive data from the database. Finally, they deployed a webshell for persistent access and defaced the website.
Kill Chain Progression
Initial Compromise
Description
Exploited REST API route confusion (CVE-2026-63030) to perform SQL injection (CVE-2026-60137), gaining unauthorized access.
Related CVEs
CVE-2026-63030
CVSS 9.8A REST API batch endpoint route confusion in WordPress versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2 allows unauthenticated attackers to perform SQL Injection and achieve Remote Code Execution when combined with CVE-2026-60137.
Affected Products:
WordPress WordPress – 6.9.0, 6.9.1, 6.9.2, 6.9.3, 6.9.4, 7.0.0, 7.0.1
Exploit Status:
exploited in the wildCVE-2026-60137
CVSS 5.9Improper sanitization of the author__not_in parameter in WP_Query in WordPress versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 allows unauthenticated SQL Injection when untrusted input is passed to the parameter.
Affected Products:
WordPress WordPress – 6.8.0, 6.8.1, 6.8.2, 6.8.3, 6.8.4, 6.8.5, 6.9.0, 6.9.1, 6.9.2, 6.9.3, 6.9.4, 7.0.0, 7.0.1
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
SQL Stored Procedures
Valid Accounts
Command and Scripting Interpreter: Windows Command Shell
Ingress Tool Transfer
Application Layer Protocol: Web Protocols
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Access Privileges
Control ID: 500.07
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Identity Management and Access Control
Control ID: Pillar 1: Identity
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
WordPress core vulnerabilities enable unauthenticated RCE attacks against web applications, requiring immediate patching of affected versions and comprehensive security auditing.
Information Technology/IT
Critical WordPress exploits demand urgent infrastructure assessment, patch management, and WAF configuration to prevent database compromise and administrative takeover.
E-Learning
Educational platforms using WordPress face severe data breach risks from SQL injection attacks, threatening student records and institutional compliance requirements.
Media Production
Content management systems vulnerable to pre-authentication RCE could enable webshell deployment, content defacement, and unauthorized access to production workflows.
Sources
- CVE-2026-63030 & CVE-2026-60137: WordPress Core Pre-Authentication RCE Overview & Takeawayshttps://www.netspi.com/blog/executive-blog/critical-vulnerability/cve-2026-63030-cve-2026-60137-wordpress-core-rce/Verified
- WordPress 7.0.2 Release – WordPress Newshttps://wordpress.org/news/2026/07/wordpress-7-0-2-release/Verified
- WordPress Core 'wp2shell' RCE flaws get public exploits, patch nowhttps://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit the attacker's ability to exploit vulnerabilities, escalate privileges, and move laterally within the environment, thereby reducing the overall blast radius.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to exploit the REST API vulnerability and perform SQL injection would likely be constrained, reducing the risk of unauthorized access.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges by creating a new admin user would likely be constrained, reducing the risk of unauthorized administrative access.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally within the environment would likely be constrained, reducing the risk of accessing sensitive data and installing malicious plugins.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish a reverse shell for command and control would likely be constrained, reducing the risk of remote command execution.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data from the database would likely be constrained, reducing the risk of data loss.
The attacker's ability to deploy a webshell for persistent access and deface the website would likely be constrained, reducing the risk of long-term compromise and reputational damage.
Impact at a Glance
Affected Business Functions
- Website Content Management
- E-commerce Transactions
- User Authentication
Estimated downtime: 7 days
Estimated loss: $50,000
Potential exposure of user credentials, payment information, and personal data.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict access between workloads and prevent lateral movement.
- • Deploy Inline IPS (Suricata) to detect and block known exploit patterns and malicious payloads.
- • Utilize Cloud Firewall (ACF) to enforce egress filtering and control outbound traffic.
- • Enhance Threat Detection & Anomaly Response capabilities to identify and respond to suspicious activities.
- • Ensure regular updates and patch management to mitigate known vulnerabilities promptly.
