Skip to content
eastbaycyber

CVE-2026-63030: "wp2shell" WordPress Core RCE Chain, Now on CISA KEV

CVE explainers 6 min read
SR
Security Research Desk Expert reviewed
Threat intelligence · Human-verified · Updated 2026-07-23
⚠
CISA Known Exploited Vulnerability

Active exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-07-21. Federal agencies must patch by 2026-07-24.

▲ Escalation ViewOne CVE, briefed at three altitudes — skim the Brief, weigh the Impact, or work the Runbook. The way a SOC actually reads it.
CISOBrief · 30-second brief

TL;DR - CVE-2026-63030 (REST API route confusion) chains with CVE-2026-60137 (SQL injection) to give an unauthenticated attacker remote code execution on default WordPress installs. - CISA added both CVEs to its Known Exploited Vulnerabilities catalog on July 21, 2026, with a patch deadline of July 24, 2026. - Update to WordPress 6.9.5 or 7.0.2+ immediately; if you can’t patch yet, block /wp-json/batch/v1 and ?rest_route=/batch/v1 at your WAF.

Vulnerability at a Glance

Field Value
CVE ID CVE-2026-63030 (chains with CVE-2026-60137)
CVSS v3.1 7.5 High (CISA-ADP) — full chain impact is critical per the vendor advisory
Attack vector Network (AV:N), no authentication, no user interaction
Auth required No — unauthenticated
Patch available Yes — WordPress 6.9.5, 7.0.2, and 7.1 Beta 2
CISA KEV Added July 21, 2026; remediation due July 24, 2026

CVE-2026-63030 is a route confusion vulnerability in the WordPress Core REST API batch endpoint. On its own it’s a logic bug, but chained with a separate SQL injection flaw, CVE-2026-60137 (in the author__not_in WP_Query parameter), it gives a remote, unauthenticated attacker a path to full remote code execution on a default WordPress installation — no plugins, no valid account, and no user interaction required. The combined exploit chain has been publicly dubbed “wp2shell.” It was discovered and reported by researchers at Searchlight Cyber.

What Is This Vulnerability?

Per Cloudflare’s technical analysis, CVE-2026-60137 is a SQL injection affecting WordPress 6.8 and later, and CVE-2026-63030 is the unauthenticated RCE affecting WordPress 6.9 and later that provides the path to exploit it. The root cause of CVE-2026-63030 is a route confusion condition in the REST API Batch Endpoint: attacker-controlled input is misrouted or interpreted incorrectly, letting a crafted request reach unintended code paths. That misrouting is what allows an anonymous request to reach the vulnerable author__not_in query construction and trigger the SQL injection, which in turn provides the primitive needed for code execution.

Rapid7 notes the vulnerable path is reachable specifically when a persistent object cache is not in use — a common default on smaller or less-optimized WordPress installs, which widens the practical blast radius beyond large, well-tuned deployments.

Technical Notes

Chain summary (from public vendor advisories, no working exploit reproduced here):
1. Anonymous request to the REST API batch endpoint (/wp-json/batch/v1 or ?rest_route=/batch/v1)
2. Route confusion (CVE-2026-63030) misroutes the request to an unintended internal handler
3. That handler reaches a WP_Query call using the unsanitized `author__not_in` parameter
4. SQL injection (CVE-2026-60137) executes attacker-controlled SQL
5. The SQL injection primitive is leveraged to achieve remote code execution
AnalystImpact · assess the risk

Who Is Affected?

WordPress branch Affected versions Fixed version
Earlier than 6.9 Not affected by CVE-2026-63030 No action required for this CVE
6.9 6.9.0 through 6.9.4 6.9.5
7.0 7.0.0 through 7.0.1 7.0.2
7.1 beta Affected beta versions not fully specified 7.1 Beta 2

Given WordPress Core’s install base, this affects a very large number of public-facing sites. WordPress maintainers say they are forcing updates for installations with automatic updates enabled, but administrators should still verify each internet-facing site has actually landed on 6.9.5, 7.0.2, or later — don’t assume auto-update succeeded, confirm it.

Exploitation Status

This moved from “disclosed” to “confirmed exploited” fast. WordPress and the GitHub Security Advisory (GHSA-ff9f-jf42-662q) went public on July 17, 2026. At that point, Rapid7 and Beazley Security both stated they were not aware of confirmed in-the-wild exploitation, and no public proof-of-concept was available — Searchlight Cyber had withheld exploit-level detail.

That changed within days. Full technical details of the exploit chain were published, multiple public proof-of-concept exploits surfaced, and CISA added both CVE-2026-63030 and CVE-2026-60137 to its Known Exploited Vulnerabilities (KEV) catalog on July 21, 2026, confirming active exploitation and setting a remediation deadline of July 24, 2026. Treat this as a live, actively exploited issue, not a theoretical one — the technical-details-to-mass-exploitation timeline here was roughly four days.

ResponderRunbook · act now

How to Detect It

Monitor for anomalous, unauthenticated requests to the REST API batch endpoint:

# Search web server / WAF logs for the vulnerable batch endpoint
grep -E "wp-json/batch/v1|rest_route=/batch/v1" /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/null

# Flag requests referencing the vulnerable query parameter
grep -i "author__not_in" /var/log/nginx/access.log 2>/dev/null

index=web_access
("/wp-json/batch/v1" OR "rest_route=/batch/v1")
| stats count by src_ip, uri_path, status

Since exploitation requires no authentication, any hit against these endpoints from an unexpected source — particularly automated scanning patterns or requests immediately followed by unusual admin/database activity — warrants investigation. If you’re behind Cloudflare, note that Cloudflare deployed managed WAF rules for this chain at 17:03 UTC on July 17, 2026; confirm those rules are active on your zone rather than assuming default coverage.

Mitigation and Patching

  1. Patch first. Upgrade to WordPress 6.9.5 (if on the 6.9 branch) or 7.0.2+ (if on 7.0), or 7.1 Beta 2 if you’re tracking the 7.1 beta channel. This is the primary, vendor-recommended fix for both CVEs in the chain.
  2. Verify, don’t assume, auto-update succeeded on every internet-facing WordPress install — check the reported version directly.
  3. If you cannot patch immediately, apply compensating controls: - Block anonymous access to the REST API, e.g. via the “Disable WP REST API” plugin from the official WordPress Plugin Directory. - Block traffic to /wp-json/batch/v1 and ?rest_route=/batch/v1 at your WAF or reverse proxy. - If you’re behind Cloudflare, confirm the managed WAF rules for this chain are enabled on your zone.
  4. Given the KEV deadline of July 24, 2026, prioritize this over routine patch cycles — federal agencies are required to remediate by that date, and it’s a reasonable bar for any internet-facing WordPress deployment.

Workarounds are not a substitute for patching — WordPress maintainers and every vendor advisory reviewed here treat the update as the actual fix, with WAF/plugin blocking as a stopgap only.

References

For more on this story as it developed, see our July 19 threat digest covering the initial wp2shell disclosure.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Last verified: 2026-07-23

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.