WordPress Issues Critical Security Updates for wp2shell Vulnerability
WordPress has unveiled pivotal security enhancements aimed at rectifying the wp2shell vulnerability, a grave oversight that permitted nefarious actors to execute remote code on susceptible sites with merely a single anonymous web request.
This anomaly diverges from numerous preceding attacks, as it circumvented the necessity for plugins, authentication, or any additional third-party code, rendering core installations especially susceptible. Security patches were implemented within WordPress versions 6.9.5 and 7.0.2.
wp2shell Vulnerability Poses Risk to Core WordPress Installations
Cataloged as CVE-2026-63030, the wp2shell vulnerability is characterized in the official WordPress release notes as a “REST API batch-route confusion and SQL injection” concern that can lead to remote code execution.
This vulnerability emerges from the REST API batch endpoint located at /wp-json/batch/v1 or its legacy query-string alias ?rest_route=/batch/v1, allowing for exploitation via a singular anonymous web request.
The vulnerability was unearthed by Adam Kues from Assetnote, a division focusing on attack surface management under Searchlight Cyber, through the WordPress HackerOne initiative.
To afford defenders ample opportunity to fortify their systems, Searchlight Cyber judiciously refrained from disseminating technical exploitation specifics, stating, “Given the egregious nature of the flaw and to ensure defenders have adequate time, we are refraining from disclosing technical specifics at this juncture.”
Critical SQL Injection Flaw Also Resolved
This security release concurrently addressed CVE-2026-60137, another significant SQL injection vulnerability. WordPress acknowledged researchers TF1T, dtro, and haongo for their role in reporting this issue.
Unlike the wp2shell vulnerability, this flaw predates the latest release and has been backported to WordPress version 6.8.6. Notably, the wp2shell vulnerability exclusively impacts versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1.
Severity assessments vary across security advisories. While WordPress designates CVE-2026-63030 as having “high severity,” the corresponding GitHub Security Advisory (GHSA-ff9f-jf42-662q) categorizes it as Critical with a CVSS score of 7.5.
Despite differing classifications, immediate action is imperative, as the wp2shell vulnerability can be exploited without requiring authentication.
Prompt Updates Highly Advised
As WordPress powers around 40% of websites globally, it has taken proactive measures by enabling enforced automatic updates for affected versions, including WordPress 7.1 beta 2, to safeguard pre-release installations.
As of July 17, there were no confirmed instances of active exploitation; however, security analysts caution that due to WordPress’s open-source nature and the immediate availability of patch-related code changes, proof-of-concept exploits could materialize within mere hours.
Administrators are urged to confirm that every internet-facing WordPress installation has successfully received the updates, as certain hosting environments may disable automatic updates or restrict websites to specific versions. Site owners can assess their exposure using the publicly available tool at wp2shell.com.
If immediate patching is infeasible, temporarily obstructing both REST API batch endpoints at the Web Application Firewall (WAF) level can mitigate risk, though this measure should not replace the crucial installation of the official update.
Furthermore, security teams overseeing multiple WordPress websites should be vigilant and monitor for surges in anonymous web request traffic targeting batch endpoints, identifying the profound security risks that can be inadvertently introduced by overlooked core features.
Source link: Thecyberexpress.com.
