/
← Voltar ao feed
critical

WP2Shell: CVE-2026-63030 and CVE-2026-60137 chained for unauthenticated RCE on default WordPress, exploitation observed

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 07:35 · coletado há 20 horas

Researchers describe WP2Shell, a chain of two WordPress core flaws, CVE-2026-63030 and CVE-2026-60137, that lets unauthenticated attackers progress from public REST API endpoints to remote code execution. It affects default installations with no third-party plugin required. Public exploit code exists and exploitation attempts have been observed, which makes unpatched sites an urgent remediation priority. F5 Labs captured attempts from 185.242.3.238 but did not observe web shell deployment. WordPress shipped fixes on July 17 and enabled forced automatic updates.

Technical Details

  • CVE-2026-63030: route confusion in the REST API batch controller (/wp-json/batch/v1). Crafted nested requests reach handlers that normally require authentication. This is the entry point, not code execution by itself.
  • CVE-2026-60137: SQL injection via the posts endpoint. The public author_exclude parameter maps to the internal author__not_in argument in WP_Query and is insufficiently sanitized.
  • Akamai describes exploitation through WordPress object caching and post-processing behavior to manipulate application state, assume an administrative context and provision a privileged account without cracking password hashes. Seqrite researchers also analyzed the chain.
  • F5 Labs observed a 735-byte payload with nested batch requests and UNION-based SQL injection from 185.242.3.238 against at least two US sensors, which indicates automated replay. The IP is observed infrastructure, not attribution.
  • Affected versions: the full chain affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. WordPress 6.8.0–6.8.5 is affected only by the SQL injection. Versions before 6.8 are unaffected.
  • Detection: look for POST requests to /wp-json/batch/v1, /?rest_route=/batch/v1 and /index.php?rest_route=/batch/v1. Look for nested request arrays, author_exclude combined with SQL keywords, hex values and encoded characters. Match on author_exclude, not author__not_in. Exploitation creates and then removes temporary temp-write-test-* files under wp-content/.
  • Host review: check for unexpected administrator accounts, newly installed plugins, modified PHP files and unusual outbound connections. A suspicious batch request alone does not prove compromise.

Remediation

  • Update to 6.8.6, 6.9.5 or 7.0.2 (or a current supported release) and verify that the forced automatic updates actually succeeded.
  • Review accounts, plugins, scheduled tasks and database changes on potentially exposed sites.
  • Where feasible, restrict unauthenticated access to the affected REST functionality. This does not replace patching or investigation.

Linha do tempo

  1. gbhackers.com ↗ · pub. 20/10/2026 07:35 · coletado 20/10 09:00 primeiro registro

    WP2Shell: CVE-2026-63030 and CVE-2026-60137 chained for unauthenticated RCE on default WordPress, exploitation observed

    ler a análise desta fonte

    Researchers describe WP2Shell, a chain of two WordPress core flaws, CVE-2026-63030 and CVE-2026-60137, that lets unauthenticated attackers progress from public REST API endpoints to remote code execution. It affects default installations with no third-party plugin required. Public exploit code exists and exploitation attempts have been observed, which makes unpatched sites an urgent remediation priority. F5 Labs captured attempts from 185.242.3.238 but did not observe web shell deployment. WordPress shipped fixes on July 17 and enabled forced automatic updates.

    Technical Details

    • CVE-2026-63030: route confusion in the REST API batch controller (/wp-json/batch/v1). Crafted nested requests reach handlers that normally require authentication. This is the entry point, not code execution by itself.
    • CVE-2026-60137: SQL injection via the posts endpoint. The public author_exclude parameter maps to the internal author__not_in argument in WP_Query and is insufficiently sanitized.
    • Akamai describes exploitation through WordPress object caching and post-processing behavior to manipulate application state, assume an administrative context and provision a privileged account without cracking password hashes. Seqrite researchers also analyzed the chain.
    • F5 Labs observed a 735-byte payload with nested batch requests and UNION-based SQL injection from 185.242.3.238 against at least two US sensors, which indicates automated replay. The IP is observed infrastructure, not attribution.
    • Affected versions: the full chain affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. WordPress 6.8.0–6.8.5 is affected only by the SQL injection. Versions before 6.8 are unaffected.
    • Detection: look for POST requests to /wp-json/batch/v1, /?rest_route=/batch/v1 and /index.php?rest_route=/batch/v1. Look for nested request arrays, author_exclude combined with SQL keywords, hex values and encoded characters. Match on author_exclude, not author__not_in. Exploitation creates and then removes temporary temp-write-test-* files under wp-content/.
    • Host review: check for unexpected administrator accounts, newly installed plugins, modified PHP files and unusual outbound connections. A suspicious batch request alone does not prove compromise.

    Remediation

    • Update to 6.8.6, 6.9.5 or 7.0.2 (or a current supported release) and verify that the forced automatic updates actually succeeded.
    • Review accounts, plugins, scheduled tasks and database changes on potentially exposed sites.
    • Where feasible, restrict unauthenticated access to the affected REST functionality. This does not replace patching or investigation.