Chaining of WordPress Core Vulnerabilities Enables Remote Code Execution
Recent investigations by Seqrite researcher Amruta Wagh have unearthed two critical vulnerabilities within WordPress Core that can be orchestrated to execute remote code without requiring authentication.
Named WP2Shell, this exploitation sequence came to light in July 2026. It intricately blends REST API route misdirection with SQL injection techniques, enabling attackers to transition from publicly accessible endpoints to complete server takeover, all while never having valid WordPress credentials in hand.
This exploit chain is particularly damaging, as it circumvents the typical prerequisite of account compromise mandated for administrative tasks, thereby furnishing a direct exploitation conduit from a compromised website.
Alarming WordPress Flaws
The initial vulnerability, CVE-2026-63030, targets the REST API batch controller found at /wp-json/batch/v1. This feature manages multiple API requests encapsulated within a single JSON payload.
Seqrite indicates that convoluted nested batch structures can obfuscate route resolution, rerouting requests to improperly designated handlers.
As a result, attackers can access functionalities that typically necessitate authenticated user status. This vulnerability alone does not execute code; rather, it presents the initial entry point necessary for the subsequent stage of the attack.
Subsequently, the second stage leverages CVE-2026-60137, an SQL injection flaw linked to the posts endpoint.
The author_exclude parameter is directly mapped to the author__not_in argument within WP_Query. Deficient input validation grants crafty entries the power to manipulate database queries.
This concatenation of vulnerabilities permits database modification via the exposed batch interface. The established exploitation sequence facilitates the creation of an admin-level account, which is then followed by the deployment of a nefarious plugin harboring a web shell.
Thus, the execution of code unfolds through a layered compromise rather than originating solely from the confusion of routes.
Notably, initial activities recorded involve temporary files resembling temp-write-test-* located within wp-content/, seemingly verifying directory writability, before they are purged.
Further, a ZIP archive, likewp2shell_4e9b3641.zip, is positioned beneath wp-content/uploads/2026/10/.
Upon extraction, PHP payloads are dispersed intowp-content/upgrade/wp2shell_/, prior to the plugin directory being transferred into wp-content/plugins/wp2shell_/.
In observed intrusions, httpd.exe facilitated these file write actions. Although standard plugin installations may yield a comparable pattern of filesystem activity, the distinctive WP2Shell filenames, unexpected PHP files, and the emergence of new administrator accounts serve as pivotal investigative clues.
Security professionals should align these artifacts with HTTP POST requests directed towards the batch endpoint as well as scrutinize nested API payloads for anomalies.
The corresponding report elaborates on proof-of-concept and lab behaviors, rather than confirming widespread exploitation.
Versions at Risk and Remediation Strategies
The recent version matrix denotes WordPress versions 6.8.0 to 6.8.5 as susceptible to the SQL injection vulnerability, albeit not the entire exploit chain. It highlights versions 6.8.6, 6.9.5, and 7.0.2 as remedied releases.
System administrators are urged to prioritize supported updates, verify administrator accounts, and probe into dubious plugin directories and PHP alterations.
Whenever operationally plausible, constraining unauthenticated access to sensitive REST API functionalities can mitigate exposure as remedial measures are enacted.
Moreover, comprehensive patching should be coupled with a compromise evaluation, acknowledging that previously deployed web shells or unauthorized accounts may persist even after the components are updated.
Source link: Gbhackers.com.
