Executive Summary
In July 2026, critical vulnerabilities known as 'wp2shell' were discovered in WordPress Core, affecting versions 6.9.x and 7.0.x. These flaws, identified as CVE-2026-63030 and CVE-2026-60137, allow unauthenticated attackers to execute remote code on default WordPress installations without any plugins. The vulnerabilities stem from a REST API batch-route confusion and an SQL injection in the 'author__not_in' parameter of 'WP_Query'. WordPress has released patches in versions 6.9.5 and 7.0.2 to address these issues.
The release of public proof-of-concept exploits has heightened the urgency for administrators to update their WordPress installations immediately. Given that WordPress powers over 500 million websites, the potential impact is vast, making prompt patching critical to prevent widespread exploitation.
Why This Matters Now
The availability of public exploits for the 'wp2shell' vulnerabilities means that attackers can now easily target unpatched WordPress sites, potentially leading to widespread compromises. Immediate action is required to secure affected installations.
Attack Path Analysis
An unauthenticated attacker exploited a REST API route confusion vulnerability (CVE-2026-63030) in WordPress Core to access the 'author__not_in' parameter of the WP_Query class, leading to SQL injection (CVE-2026-60137) and remote code execution. The attacker then escalated privileges by executing arbitrary code on the server, potentially gaining administrative access. Subsequently, the attacker moved laterally within the network, targeting other systems and services. A command and control channel was established to maintain persistent access and control over the compromised systems. The attacker exfiltrated sensitive data from the server to an external location. Finally, the attacker deployed ransomware, encrypting critical files and demanding payment for decryption.
Kill Chain Progression
Initial Compromise
Description
An unauthenticated attacker exploited a REST API route confusion vulnerability (CVE-2026-63030) in WordPress Core to access the 'author__not_in' parameter of the WP_Query class, leading to SQL injection (CVE-2026-60137) and remote code execution.
Related CVEs
CVE-2026-63030
CVSS 9.8A REST API batch endpoint route confusion in WordPress versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2, which, when combined with CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
Affected Products:
WordPress WordPress – 6.9.0, 6.9.1, 6.9.2, 6.9.3, 6.9.4, 7.0.0, 7.0.1
Exploit Status:
proof of conceptCVE-2026-60137
CVSS 5.9Improper sanitization of the author__not_in parameter in WP_Query in WordPress versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
Affected Products:
WordPress WordPress – 6.8.0, 6.8.1, 6.8.2, 6.8.3, 6.8.4, 6.8.5, 6.9.0, 6.9.1, 6.9.2, 6.9.3, 6.9.4, 7.0.0, 7.0.1
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Web Shell
Command and Scripting Interpreter: Windows Command Shell
Application Layer Protocol: Web Protocols
Valid Accounts: Default Accounts
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Access Privileges
Control ID: 500.07
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Asset Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Internet
WordPress wp2shell RCE vulnerabilities expose web platforms to pre-authentication remote code execution, requiring immediate patching and WAF protection implementation.
Computer Software/Engineering
Critical WordPress Core flaws enable SQL injection and REST API exploitation, threatening software development platforms and requiring enhanced security controls.
Media Production
WordPress-dependent content management systems face severe compromise risk from public exploits, demanding urgent updates and egress filtering deployment.
Marketing/Advertising/Sales
WordPress-hosted marketing platforms vulnerable to unauthenticated RCE attacks, necessitating immediate patching and anomaly detection system implementation for protection.
Sources
- WordPress Core "wp2shell" RCE flaws get public exploits, patch nowhttps://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/Verified
- WordPress 7.0.2 Releasehttps://wordpress.org/news/2026/07/wordpress-7-0-2-release/Verified
- wp2shell: Pre Authentication RCE in WordPress Corehttps://wp2shell.com/Verified
- NVD - CVE-2026-63030https://nvd.nist.gov/vuln/detail/CVE-2026-63030Verified
- NVD - CVE-2026-60137https://nvd.nist.gov/vuln/detail/CVE-2026-60137Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit the attacker's ability to move laterally, escalate privileges, and exfiltrate data by enforcing strict segmentation and identity-aware policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While the initial exploitation may still occur, CNSF would likely limit the attacker's ability to leverage the compromised workload to access other systems or sensitive data.
Control: Zero Trust Segmentation
Mitigation: Zero Trust Segmentation would likely limit the attacker's ability to escalate privileges beyond the compromised workload, reducing the risk of administrative access to other systems.
Control: East-West Traffic Security
Mitigation: East-West Traffic Security would likely constrain the attacker's ability to move laterally, limiting their reach to other systems and services within the network.
Control: Multicloud Visibility & Control
Mitigation: Multicloud Visibility & Control would likely detect and limit the establishment of unauthorized command and control channels, reducing the attacker's ability to maintain persistent access.
Control: Egress Security & Policy Enforcement
Mitigation: Egress Security & Policy Enforcement would likely limit the attacker's ability to exfiltrate sensitive data by controlling and monitoring outbound traffic.
While the initial ransomware deployment may still occur, the attacker's ability to spread the ransomware to other systems would likely be constrained, reducing the overall impact.
Impact at a Glance
Affected Business Functions
- Website Content Management
- E-commerce Transactions
- User Authentication
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of user credentials and personal information.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Inline IPS (Suricata) to detect and prevent exploitation of known vulnerabilities like CVE-2026-63030 and CVE-2026-60137.
- • Deploy Zero Trust Segmentation to limit lateral movement within the network, restricting unauthorized access between systems.
- • Utilize East-West Traffic Security to monitor and control internal traffic, detecting anomalous behavior indicative of lateral movement.
- • Establish Egress Security & Policy Enforcement to prevent unauthorized data exfiltration by controlling outbound traffic.
- • Enhance Threat Detection & Anomaly Response capabilities to identify and respond to suspicious activities promptly, reducing the impact of potential breaches.
