VulnSocial
← Back to blog

CVE-2026-63030 – Critical Pre‑Authentication RCE in WordPress Core (wp2shell)

Key takeaways

  • Severity: Critical remote code execution.
  • Impact: Unauthenticated attacker can gain full system control on a default WordPress install.
  • Affected versions: 6.9.0‑6.9.4, 7.0.0‑7.0.1 (pre‑patched).
  • Immediate action: Update to 6.9.5 or 7.0.2, or apply the temporary mitigation steps below.
  • Monitoring: Track live exploitation signals on the VulnSocial CVE page.

Overview

On July 17 2026, WordPress.org disclosed a pre‑authentication remote code execution (RCE) flaw in the core software, dubbed “wp2shell”. The issue is tracked as CVE-2026-63030 (and the related SQL injection CVE-2026-60137). No authentication, plugins, or special configuration is required – a plain stock installation is exploitable.

Technical details

The exploit chains two independent bugs:

  1. REST batch route confusion (CVE‑2026‑60137) – An unauthenticated SQL injection occurs when a crafted request is sent to the /wp-json/wp/v2/batch/v1 endpoint. The injection can manipulate the WP_Query SQL used by the core.
  2. WP_Query RCE (CVE‑2026‑63030) – The injected query can write arbitrary PHP code to the uploads directory or trigger eval() through the post_content field, resulting in full command execution.

Because both bugs exist in the default core, the chain works on a fresh install with no plugins. Public proof‑of‑concepts (PoCs) appeared on GitHub within days of disclosure, and active exploitation reports began on July 18 2026, with multiple exploit tools observed in the wild.

Severity & impact

  • CVSS: Not yet published by NVD, but the combination of unauthenticated access and full RCE warrants a Critical rating.
  • Confidentiality, Integrity, Availability: Complete compromise of the web server, potential lateral movement, and data exfiltration.

Affected products

  • WordPress Core 6.9.0 – 6.9.4
  • WordPress Core 7.0.0 – 7.0.1

For the exhaustive list of affected versions and downstream distributions, see the official CVE page: https://vulnsocial.com/cve/CVE-2026-63030.

What you should do now

StepAction
1Verify your current WordPress version (wp-admin > Updates or wp core version).
2Patch immediately to 6.9.5 or 7.0.2, which contain the official fix.
3If patching is not possible, temporarily block the REST batch endpoint:
<LocationMatch "/wp-json/wp/v2/batch/v1">\n Require all denied\n</LocationMatch> (web‑server level) or disable the REST API via a security plugin.
4Restrict access to the REST API to trusted IPs or authenticated users.
5Deploy a WAF rule that drops POST requests to /wp-json/wp/v2/batch/v1 containing suspicious sql parameters.
6Monitor logs for anomalous batch requests (e.g., large POST bodies, repeated 500 responses).
7Subscribe to live threat intel on the VulnSocial CVE page to see new exploit attempts or indicator spikes.

Remediation & mitigation checklist

  1. Apply the official patch.
  2. Disable the REST batch route if you cannot upgrade immediately.
  3. Enforce authentication on all REST API endpoints.
  4. Implement a WAF rule to block the specific payload pattern used by the PoC.
  5. Audit file system for unexpected PHP files in wp-content/uploads.
  6. Rotate credentials for any accounts that may have been compromised.

References

Bottom line

CVE-2026-63030 is a Critical pre‑authentication RCE that can compromise any WordPress site running the affected core versions. The fastest defense is to update to the patched releases; if that is not feasible, apply the mitigation steps above and monitor for exploitation activity.

#hashtags

#CVE #Critical #RCE #WordPress #CVE202663030