A bare WordPress site, devoid of any plugins, remained susceptible to exploitation via a solitary, anonymous web request until just yesterday.
The wp2shell vulnerability, which amalgamated a REST API route confusion flaw with SQL injection, afforded unauthenticated attackers remote code execution capabilities on core systems.
Remarkably, this vulnerability required neither login credentials nor third-party code. Patches were promptly issued in versions 6.9.5 and 7.0.2 of WordPress.
Understanding the wp2shell Vulnerability
WordPress catalogues this particular security vulnerability as CVE-2026-63030 in its official release notes. The description characterizes it as a “REST API batch-route confusion and SQL injection” that leads to remote code execution.
The initial point of entry is the batch endpoint located at/wp-json/batch/v1, or alternatively accessed through the older query-string alias ?rest_route=/batch/v1.
According to an advisory from Rapid7, the vulnerability poses a greater threat in instances where persistent object caching is disabled, a situation common among shared hosting environments.
Adam Kues from Assetnote, an attack surface management division of Searchlight Cyber, unearthed and reported this vulnerability using WordPress’s HackerOne program.
Searchlight Cyber prepared an analytical summary but deliberately withheld exploitation details to allow defenders the necessary time to implement patches.
As articulated in their report, “given the egregious nature of the flaw and to ensure defenders have adequate time, we are refraining from disclosing technical specifics at this juncture.”
A Secondary Vulnerability Discovered
In addition to wp2shell, a second critical SQL injection vulnerability, identified as CVE-2026-60137, was included in the same release.
WordPress acknowledged researchers TF1T, dtro, and haongo for their contributions in identifying this issue.
Notably, this second flaw has historical roots, as it predates the wp2shell vulnerability and was consequently backported to version 6.8.6, whereas wp2shell exclusively impacts versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1.
The categorization of severity for these vulnerabilities warrants scrutiny. There appears to be a disparity in assessments across various platforms.
WordPress’s release notes classify the batch-endpoint vulnerability as “high severity,” whereas the GitHub Security Advisory for the same issue, referenced as GHSA-ff9f-jf42-662q, labels it as Critical with a CVSS score of 7.5.
Rapid7 adopts this Critical framing throughout its advisory. Relying solely on WordPress’s internal severity classification could lead to an underestimation of the wp2shell vulnerability compared to CVE-2026-60137, categorized as critical by WordPress itself.
Both vulnerabilities necessitate immediate attention, especially given that wp2shell requires no authentication whatsoever.
The Importance of Rapid Response
WordPress powers an estimated 40% of all websites, making the potential for a pre-authentication core RCE without preconditions alarmingly critical. In response, WordPress activated forced updates via its auto-update feature.
Consequently, every site operating on affected versions received the patch automatically, regardless of the administrator’s actions.
Additionally, WordPress 7.1 beta2 was included in the backport process, effectively sealing off the pre-release channel as well.
As per Rapid7’s findings, there was no confirmed exploitation in the wild as of their July 17 report. Nevertheless, they caution that this situation may not remain unchanged.
Given that WordPress core is open-source, Rapid7 expressed a stark assessment: “Rapid7 Labs anticipates that it is highly likely a public proof-of-concept will soon become available.”
The code differences between versions 7.0.1 and 7.0.2 were made public immediately upon the deployment of the patch, and contemporary tools can rapidly convert that information into an exploit within hours, not weeks.
This vulnerability underscores a persistent issue within core software systems. The REST API batch endpoint amalgamates multiple sub-requests into a single call for the sake of convenience.
However, such convenience features are often implemented well after the authentication and routing protocols have been established and reviewed, creating a chasm that can lead to vulnerabilities. This flaw represents a classic case where the framework is overly trusting of certain routes.
Guidance for Defenders Concerning the wp2shell Vulnerability
It is imperative for administrators to verify that every internet-facing WordPress installation has applied the forced update.
One should not simply assume compliance, as some sites may have auto-updates disabled at the host level or could be restricted to a specific release by management tools.
Site owners can utilize a public checking tool available at wp2shell.com to assess vulnerability exposure directly.
Furthermore, Rapid7 states that its Exposure Command and InsightVM tools will incorporate checks for CVE-2026-63030 beginning July 20. Teams already leveraging these tools will have a swift, organization-wide method for confirming their patch status.
If immediate core updates are unfeasible, Rapid7 advises blocking the batch endpoint at the WAF (Web Application Firewall) layer as a temporary measure.
Blocking both the REST path and the query-string alias is crucial since either route can access the same vulnerable code. While this may provide some breathing space, it does not replace the necessity of a patch.
Rapid7 emphasizes that reliance on workarounds should not be viewed as a long-term solution; any WAF rule should be regarded as a provisional measure pending updates.
Those managing multiple WordPress sites should also consider whether their monitoring systems would effectively detect a surge in anonymous POST requests targeting a batch endpoint, a point often overlooked by administrators.
The wp2shell vulnerability illustrates that critical flaws often lurk in the less scrutinized areas of the core framework. Future vulnerabilities are unlikely to announce themselves any more vociferously than this one.
Source link: Latesthackingnews.com.
