The WordPress ecosystem faced a significant security breach, exacerbated by the wp2shell vulnerability, which had previously allowed a single, anonymous web request to exploit a bare site devoid of any plugins.
This exploit entwined a REST API routing confusion with an SQL injection flaw, permitting an unauthenticated attacker to execute remote code directly within the core of WordPress.
With no login credentials needed and absent third-party scripts, this vulnerability was alarming. Fortunately, WordPress fortified its defenses in versions 6.9.5 and 7.0.2.
Understanding the wp2shell Vulnerability
Categorized as CVE-2026-63030 in WordPress’s security release notes, this vulnerability is described as a fusion of “REST API batch-route confusion and SQL injection,” culminating in the potential for remote code execution.
The initial breach point resides at the batch endpoint located at/wp-json/batch/v1, or alternatively, the older query-string alias ?rest_route=/batch/v1.
Rapid7’s report indicates that the exploitation proves most harmful when persistent object caching is disabled, a scenario frequently encountered on typical shared hosting environments.
The flaw was unearthed and reported by Adam Kues, part of Assetnote—a division of Searchlight Cyber focused on attack surface management—utilizing WordPress’s HackerOne program.
Searchlight Cyber disseminated a summary but judiciously refrained from releasing exhaustive exploitation details.
As conveyed in their publication, “in light of the bug’s severity, and to afford defenders adequate time to implement patches, we are withholding technical specifics at this juncture.”
A Concurrent Bug Finding
In the same release, an unrelated yet critical SQL injection flaw, identified as CVE-2026-60137, was also disclosed.
WordPress acknowledged researchers TF1T, dtro, and haongo for their contributions in identifying this vulnerability, which dates further back than wp2shell and was consequently backported to version 6.8.6. Conversely, the wp2shell vulnerability affects versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1.
Disentangling the severity assessments is crucial, as discrepancies exist among various sources. WordPress’s release notes classify the batch-endpoint vulnerability as “high severity,” while the corresponding GitHub Security Advisory, GHSA-ff9f-jf42-662q, categorizes it as Critical, attributing a CVSS score of 7.5.
Rapid7 adheres to the GHSA’s assessment in its advisory. It is essential to avoid relying solely on WordPress’s internal severity ratings for triaging patches, as this may underestimate the urgency posed by wp2shell compared to CVE-2026-60137, which WordPress categorizes as critical.
Both vulnerabilities demand equal attention, especially considering wp2shell’s lack of authentication requirements.
Urgency of the Patch
WordPress operates on approximately forty percent of websites globally. A pre-authentication remote code execution vulnerability, devoid of preliminary conditions, epitomizes a severe threat within this digital landscape.
In response, the WordPress project activated mandatory updates via its auto-update mechanism. As a result, every site still utilizing an affected version received an update, regardless of whether site owners initiated the action.
Furthermore, WordPress version 7.1 beta2 also incorporated this patch, thus securing the pre-release environment.
As of Rapid7’s report on July 17, no confirmed exploitation had been observed in the wild. However, the firm is cautious, expressing skepticism regarding the longevity of this status.
Given the open-source nature of WordPress’s core, Rapid7 noted bluntly: “It’s highly probable that a public Proof of Concept (PoC) will emerge imminently.”
The diff between versions 7.0.1 and 7.0.2 was made public immediately upon the patch’s release, enabling modern tools to transmute that difference into a functioning exploit swiftly—within hours rather than weeks.
The vulnerability also surfaces within a familiar conundrum associated with core software. The REST API’s batch endpoint aggregates several sub-requests into a singular call, enhancing user convenience.
Such convenience-oriented features often materialize long after the surrounding authentication and routing logic has been scrutinized and validated, creating vulnerabilities—such as this one—where the framework grants excessive trust to particular routes.
Recommended Actions for Defenders
Site administrators should verify that all internet-facing WordPress installations successfully implemented the mandatory update.
It is critical not to operate under the assumption of compliance. Certain sites might have auto-updates disabled at the host level, while others could be restricted to a specific version by a management tool, potentially missing the update altogether.
Site owners can directly assess their exposure using a tool available at wp2shell.com. Rapid7 has also indicated that its Exposure Command and InsightVM tools will integrate checks for CVE-2026-63030 starting July 20.
Organizations utilizing these tools will acquire an expedient, comprehensive method for confirming patch application across their networks.
For those unable to promptly update the core system, Rapid7 suggests preemptively blocking the batch endpoint at the WAF layer as an interim measure.
It is important to obstruct both the REST path and its query-string alias, as either leads to the vulnerable code. While this buys time, it cannot replace the necessity for a proper patch.
Rapid7 firmly advises against relying on workarounds as a long-term strategy, emphasizing that any WAF rule should serve merely as a temporary bridge to a definitive update.
Additionally, any entity managing multiple WordPress sites should evaluate something simpler: will your monitoring systems detect a surge of anonymous POST requests directed at a batch endpoint that most administrators frequently overlook?
The wp2shell vulnerability underscores a critical truth: often, the most pernicious bugs are hidden within the core functionalities that attract the least attention. The next vulnerability may not announce its presence any more conspicuously than this one.
Source link: Latesthackingnews.com.
