Skip to main content

Critical WordPress Core Vulnerability (wp2shell): Patch Immediately

By

Published: July 19, 2026

Severity: Critical

Executive Summary

A critical vulnerability chain, publicly known as wp2shell, affects the WordPress Core REST Batch API. The issue enables an unauthenticated attacker to abuse the Batch API, trigger a SQL injection condition, and potentially achieve Remote Code Execution (RCE).

Unlike many WordPress compromises, this vulnerability does not require a vulnerable plugin or theme. The flaw exists within WordPress Core, meaning any internet-facing installation running an affected version may be vulnerable.

The exposed endpoints include:

  • /wp-json/batch/v1

  • /?rest_route=/batch/v1

WordPress addressed these vulnerabilities in security releases published on July 17, 2026. Organizations should immediately upgrade to:

  • WordPress 7.0.2 or later

  • WordPress 6.9.5 or later

  • WordPress 6.8.6 or later (related SQL injection fix)

Temporary mitigations, such as WAF rules or application-layer protections, may reduce immediate exposure but are not substitutes for installing the official security update.

Immediate Action: Inventory every WordPress deployment—including production, staging, development, customer portals, and legacy installations—and verify that each instance has been updated successfully.

Overview

WordPress provides a REST Batch API that allows multiple REST requests to be processed within a single HTTP request.

Researchers discovered a critical weakness (CVE-2026-63030) in the Batch API's internal request routing. Under specific conditions, malformed requests can desynchronize request validation from route execution, allowing later requests to be processed in an unintended security context.

When combined with CVE-2026-60137, a SQL injection vulnerability affecting WP_Query, attackers may chain both flaws to achieve complete compromise of vulnerable WordPress installations.

This advisory intentionally excludes exploit payloads and offensive proof-of-concept code. Administrators only need sufficient technical detail to identify affected systems, assess risk, and apply the official remediation.

Why This Matters

The reported vulnerability chain is particularly severe because it is:

  • Unauthenticated — No valid WordPress account is required.

  • Remote — Exploitable over standard HTTP(S).

  • Core-Level — No vulnerable plugins or themes are necessary.

  • High Impact — May result in SQL injection, privilege escalation, and Remote Code Execution.

  • Widely Discoverable — The affected REST endpoint is publicly exposed on most default installations.

A successful compromise could allow an attacker to:

  • Gain administrative access

  • Modify website content

  • Install malicious plugins or backdoors

  • Steal sensitive database information

  • Execute arbitrary PHP code

  • Establish long-term persistence

  • Use the compromised server to launch additional attacks

Because the vulnerability affects WordPress Core itself, organizations should treat this as an emergency patching event.

Affected Versions

The following WordPress releases are publicly reported as vulnerable.

Branch                             Vulnerable VersionsFixed Version
WordPress 7.07.0.0 – 7.0.17.0.2
WordPress 6.96.9.0 – 6.9.46.9.5

The related SQL injection vulnerability was also addressed in WordPress 6.8.6.

Organizations should always deploy the latest supported security release rather than relying solely on version ranges.

Technical Summary

The REST Batch API processes multiple API requests within a single transaction.

In vulnerable releases, malformed requests can interrupt internal request parsing without correctly synchronizing validation and route handling. Subsequent requests may therefore execute against unintended handlers, bypassing expected validation and permission checks.

Researchers demonstrated that this routing weakness can be chained with the WP_Query SQL injection vulnerability, allowing attackers to progress from an unauthenticated request to complete system compromise under vulnerable conditions.

The Batch API should therefore be considered the initial entry point for the broader wp2shell attack chain rather than an isolated REST API issue.

Recommended Response

Organizations should prioritize the following actions immediately:

  1. Upgrade every WordPress installation to a patched release.

  2. Verify the installed version after updating.

  3. Review all internet-facing WordPress assets, including forgotten staging environments.

  4. Inspect administrator accounts, plugins, uploads, scheduled tasks, and server logs for signs of compromise.

  5. Restrict anonymous access to the Batch API until all systems have been patched.

  6. Rotate credentials, API keys, authentication secrets, and WordPress salts if compromise is suspected.

Temporary mitigations may reduce exposure, but patching WordPress Core remains the only permanent remediation.

Conclusion

The wp2shell vulnerability chain represents one of the most significant WordPress Core security issues in recent years. Because exploitation begins with an unauthenticated request and can ultimately result in Remote Code Execution, organizations should treat remediation as an emergency.

Update every WordPress deployment immediately, verify the installed version, monitor for suspicious Batch API activity, and perform a post-patch compromise assessment where exposure is suspected.

Rapid patching is the only reliable long-term defense against this vulnerability.

Labels:

Comments

Post a Comment

Popular posts from this blog

DVWA CHEAT SHEET

By
“If you’re waiting for permission to break the system, you’re already too late.” What You’re Actually Dealing With DVWA isn’t random vulnerable code. It’s a deliberately broken system designed to teach how real applications fail — SQL injection, XSS, command execution, file inclusion, all of it ( edgenexus.io ) Multiple difficulty levels exist for one reason: To show you how weak defenses evolve into real ones. 0. Core Principle You don’t memorize payloads. You understand flow. Input → Application Logic → Output If you control input, you control logic. If you control logic, the rest is just execution. 1. SQL Injection “You don’t bypass authentication. You redefine it.” Break the query ' Error means the application is exposing its internal structure. Take control ' OR '1'='1 # You’re not logging in. You’re forcing the query to return true. Map columns ' ORDER BY 1-- ' ORDER BY 2-- You’re learning how the database thinks. Extract data ' UNION SELECT datab...
Post a Comment
Read more

Greed - Kinnaird CTF

By
Greed Challenge — RSA Low-Exponent Write-Up Overview This challenge revolves around a classic RSA weakness: using a small public exponent (e = 3) without proper padding . Under the right conditions, this allows direct recovery of the plaintext by taking an integer cube root of the ciphertext. The task is to identify the real encrypted flag among several decoys and exploit this mathematical flaw. Key Observations RSA Parameters Public exponent: e = 3 (Narratively hinted as the warden’s “three kingdoms”) Modulus size: ~254 bits Candidate ciphertext: 0x1aadb93ce9a5704a83345e00 Critical Hint “Sometimes the treasure is so light that it never touches the vault walls.” This implies the plaintext m is small enough that: m³ < N When this happens, RSA encryption becomes: c = m³ instead of: c = m³ mod N No modular reduction occurs — which is exactly what enables the attack. Cryptographic Background RSA encryption is defined as: c = m^e mod N If m^e < N , then: c = m^e For e = 3 , recove...
Post a Comment
Read more

Pride - Kinnaird CTF

By
Writeup: Pride Challenge (Reverse Engineering) Challenge Overview Pride is a multi-layered Windows reverse engineering challenge. It requires the researcher to navigate through a protective "shell" ( UPX ), bypass environmental checks ( Anti-Debugging/Anti-VM ), and eventually reverse-engineer a custom Virtual Machine (VM) architecture to extract the hidden flag fragment. 1. Initial Analysis & Unpacking The binary initially presents a decoy flag. Analysis with PEiD or Detect It Easy (DIE) reveals the executable is compressed with UPX . Manual Unpacking While a standard upx -d pride.exe is the first step, this challenge utilizes a modified UPX header . To unpack manually: Load the binary in x64dbg . Look for the POPAD instruction followed by a large JMP —this is the jump to the Original Entry Point (OEP) . Use Scylla to dump the process and fix the IAT ( Import Address Table ). 2. Anti-Analysis Bypassing Once unpacked, the binary performs several checks to ensure it...
Post a Comment
Read more