{"id":"wordpress-wp2shell-core-rce-jul-2026","category":"patch","status":"closed","title":"WordPress Core \"WP2Shell\" flaws CVE-2026-63030 and CVE-2026-60137 let attackers run code without logging in","tldr":"Two WordPress Core flaws, chained, let anyone run code on a site without logging in. CISA lists them as exploited. Fixed in WordPress 7.0.2, 6.9.5 and 6.8.6; check your site is on one of those, or ask whoever manages it.","summary":"Two flaws in WordPress Core, the software behind a large share of websites, can be chained so that an attacker who is not logged in can run their own code on the site. One is a SQL injection in how WordPress builds database queries (CVE-2026-60137). The other is a confusion in the REST API's batch endpoint (CVE-2026-63030) that gets around the restriction that otherwise limits the injection to logged-in users. WordPress released fixes on 17 July 2026: 7.0.2, 6.9.5 and 6.8.6, and said it was forcing updates on sites that support automatic updates. Versions before 6.8 are not affected. The full code-execution chain affects 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1; 6.8.0 to 6.8.5 is affected only by the SQL injection. The WordPress project's own release notice did not mention attacks, but New Zealand's NCSC reported active exploitation on 20 July and CISA listed both flaws as exploited on 21 July. Public proof-of-concept exploits are reported to exist. A fix is available for every supported version. Sites that did not update automatically remain exposed.","action":"If you run a WordPress site, update it now to 7.0.2, 6.9.5 or 6.8.6 (Dashboard, then Updates), or ask your web host or developer to confirm it is on one of those versions. Check the site for unfamiliar admin users or plugins if it ran an older version after 17 July.","product":"WordPress Core (self-hosted WordPress websites)","audience":"both","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-60137","CVE-2026-63030"],"tags":["wordpress","cms","remote-code-execution","sql-injection","rest-api","cisa-kev","wp2shell","website"],"affected":["WordPress 6.8.0 to 6.8.5 (CVE-2026-60137 only)","WordPress 6.9.0 to 6.9.4","WordPress 7.0.0 to 7.0.1"],"fixed":["WordPress 6.8.6","WordPress 6.9.5","WordPress 7.0.2","WordPress 7.1 beta2"],"matches":[],"sources":[{"kind":"advisory","title":"WordPress 7.0.2 Security Release","url":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/","by":"WordPress.org","date":"2026-07-17"},{"kind":"advisory","title":"REST API batch-route confusion and SQL injection leading to RCE (GHSA-ff9f-jf42-662q)","url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q","by":"WordPress (GitHub advisory)","date":"2026-07-17"},{"kind":"advisory","title":"Facilitated SQL injection in WP_Query author__not_in (GHSA-fpp7-x2x2-2mjf)","url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf","by":"WordPress (GitHub advisory)","date":"2026-07-17"},{"kind":"advisory","title":"CVE-2026-63030 and CVE-2026-60137 affecting WordPress","url":"https://www.ncsc.govt.nz/alerts/cve-2026-63030-and-cve-2026-60137-affecting-wordpress/","by":"NCSC New Zealand","date":"2026-07-20"},{"kind":"research","title":"WordPress wp2shell Vulnerabilities Exploited in the Wild (CVE-2026-63030 & CVE-2026-60137)","url":"https://threatprotect.qualys.com/2026/07/20/wordpress-wp2shell-vulnerabilities-exploited-in-the-wild-cve-2026-63030-cve-2026-60137/","by":"Qualys","date":"2026-07-30"}],"started":"2026-07-17","closed":"2026-07-21","created":"2026-11-03T21:43:54.558Z","updated":"2026-11-03T21:43:54.558Z","cve_notes":[{"cve":"CVE-2026-60137","name":"SQL injection in WordPress WP_Query author__not_in","what":"A SQL injection in the author__not_in parameter of WP_Query, WordPress's query builder, that on its own affects 6.8 and later and, chained with CVE-2026-63030, lets an unauthenticated attacker run code on the site.","severity":"medium","cvss":5.9},{"cve":"CVE-2026-63030","name":"REST API batch-route confusion in WordPress Core","what":"A route confusion flaw in WordPress's REST API batch endpoint, in 6.9 and later, that lets an attacker reach the SQL injection without logging in and so achieve remote code execution.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-07-21","added":"2026-11-03T21:41:32.717Z","kind":"cisa-added","text":"CISA added both CVEs to its Known Exploited Vulnerabilities catalogue, with a federal patch deadline of 24 July 2026.","url":"https://threatprotect.qualys.com/2026/07/20/wordpress-wp2shell-vulnerabilities-exploited-in-the-wild-cve-2026-63030-cve-2026-60137/","by":"Qualys","patch":null},{"at":"2026-07-20","added":"2026-11-03T21:41:32.717Z","kind":"wider-attacks","text":"New Zealand's NCSC warned that both flaws were under active exploitation and could be chained by an unauthenticated attacker to run code.","url":"https://www.ncsc.govt.nz/alerts/cve-2026-63030-and-cve-2026-60137-affecting-wordpress/","by":"NCSC New Zealand","patch":null},{"at":"2026-07-17","added":"2026-11-03T21:41:32.717Z","kind":"other","text":"WordPress published advisories for both flaws. The batch-route flaw is rated critical and, combined with the SQL injection, leads to remote code execution on 6.9 and 7.0. The SQL injection alone is rated moderate and also affects 6.8.","url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q","by":"WordPress (GitHub advisory)","patch":null},{"at":"2026-07-17","added":"2026-11-03T21:41:32.717Z","kind":"disclosed","text":"WordPress released 7.0.2, with backports 6.9.5 and 6.8.6, fixing a SQL injection (CVE-2026-60137) and a REST API batch-route confusion flaw (CVE-2026-63030). The project said it was forcing updates through auto-update on affected sites.","url":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/","by":"WordPress.org","patch":"patched"}],"url":"https://hard.fyi/live/wordpress-wp2shell-core-rce-jul-2026/","json":"https://hard.fyi/api/live?id=wordpress-wp2shell-core-rce-jul-2026"}