wp2shell
- Product
- WordPress WordPress Core (REST API batch endpoint, WP_Query)
- CVE
- CVE-2026-63030CVE-2026-60137
- Disclosed
- 2026-07-17
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1 (the SQLi alone also affects 6.8.0-6.8.5)
- Fixed
- 6.9.5, 7.0.2 (6.8.6 for CVE-2026-60137)
Summary
Adam Kues of Searchlight Cyber chained a REST API batch-routing logic flaw with a SQL injection to get pre-authentication RCE on a stock WordPress install with no plugins. Public PoCs appeared within hours, and multiple threat actors exploited it to upload web-shell plugins. WordPress.org enabled forced auto-updates for affected sites.
Root cause
The /wp-json/batch/v1 handler validates sub-requests in one loop and executes them in a second, using two parallel arrays ($validation and $matches). A malformed sub-request updates $validation but hits a continue before $matches, shifting them by one, so a sub-request is validated against one route's rules but run by the next route's handler (CVE-2026-63030); nesting a batch inside a batch also skips the GET-method check. That lets a scalar author__not_in (author_exclude) reach GET /wp/v2/posts, where only array input gets absint(), giving unauthenticated SQL injection in WP_Query (CVE-2026-60137). The researcher then used UNION-forged post objects, oEmbed cache rows and a forged customize_changeset to assume the administrator's identity, create an admin account, and upload a plugin for code execution.
Impact
Unauthenticated full site takeover and code execution as the web server user on default WordPress 6.9/7.0 sites.
Detection
Anonymous requests to /wp-json/batch/v1 or ?rest_route=/batch/v1 (especially nested batch calls); new administrator accounts; unexpected plugin uploads or PHP files in wp-content. Searchlight Cyber's checker is at wp2shell.com.
Mitigation
Update to 6.9.5 / 7.0.2; until then block anonymous access to the batch endpoint at the WAF. After patching, audit for rogue admins and web shells.