Critical wp2shell Vulnerabilities CVE-2026-63030 and CVE-2026-60137 Trigger Global Exploitation Wave Targeting WordPress Installations

The global cybersecurity landscape has been placed on high alert following the discovery and rapid exploitation of a devastating vulnerability chain within the WordPress core software. Collectively codenamed "wp2shell," the two security flaws, tracked as CVE-2026-63030 and CVE-2026-60137, allow unauthenticated attackers to achieve remote code execution (RCE) on default installations. This exploit chain grants threat actors the ability to gain complete control over affected websites without requiring any prior access, credentials, or specific plugin configurations. The severity of the situation is underscored by reports from multiple security firms indicating that mass exploitation is already underway, targeting organizations across every major industry vertical.

The Technical Anatomy of wp2shell

The wp2shell exploit is a sophisticated two-stage attack that leverages a combination of "route confusion" and improper data sanitization. At its core, the vulnerability resides in how WordPress handles internal requests through its REST API and how it processes database queries via its primary query class, WP_Query.

The first link in the chain is CVE-2026-60137, a critical flaw in the WordPress REST API batch endpoint. Security researchers have identified this as a route confusion bug. In a standard environment, the REST API requires authentication for sensitive operations. However, this flaw allows an anonymous user to craft a specific HTTP request that confuses the routing logic, effectively bypassing authentication checks. This allows the attacker to invoke internal handlers and endpoints that were never intended to be exposed to the public internet.

Once the authentication bypass is achieved, the attacker moves to the second stage: CVE-2026-63030. This is a SQL injection vulnerability found within the WP_Query class, specifically involving the author__not_in parameter. When untrusted data is passed to this parameter, the software fails to properly sanitize the input before incorporating it into a database query. By exploiting this, an attacker can manipulate the SQL statement to exfiltrate sensitive data, such as hashed administrative credentials, or further escalate the attack to achieve remote code execution.

According to technical analysis from Cloudflare, the path to RCE via CVE-2026-63030 is particularly potent when a persistent object cache is not in use. While the SQL injection component affects WordPress versions from 6.8 onwards, the full RCE chain is most effective on versions 6.9 and later. The "stock" nature of the vulnerability—meaning it exists in the core code rather than a third-party plugin—makes it one of the most significant threats to the WordPress ecosystem in recent years.

Chronology of Discovery and Exploitation

The timeline of the wp2shell crisis reveals a rapid transition from theoretical discovery to active, wide-scale threat.

• December 2025: The code changes that introduced the vulnerabilities were integrated into the WordPress core during a routine update cycle.
• June 2026: Researchers at Searchlight Cyber utilized OpenAI’s GPT 5.6 Sol, a high-reasoning artificial intelligence model, to audit the WordPress source code. The AI identified the exploit chain in just over 10 hours of analysis—a task that might have taken human researchers weeks or months to pinpoint.
• Early July 2026: Following the discovery, a limited disclosure was made to the WordPress security team. However, technical details began to circulate within the security community and, subsequently, on underground forums.
• Saturday, July 11, 2026 (02:00 UTC): Security firm watchTowr observed the first wave of successful exploitations. Initial attacks focused on using public exploit code to exfiltrate database hashes.
• July 12, 2026 – Present: As more technical details became public, the attacks shifted from data exfiltration to full RCE. Mass scanning campaigns were detected globally, with attackers attempting to "spray" the exploit across the entire IPv4 address space.

Global Impact and Telemetry Data

The scale of the attack is vast, reflecting WordPress’s position as the engine behind more than 40% of the world’s websites. Telemetry data from KEVIntel has identified at least 13 unique, high-volume IP addresses spearheading the exploitation. these sources are geographically distributed across Switzerland, Germany, the United Kingdom, Indonesia, Lithuania, the Netherlands, and Singapore.

Wiz, a cloud security provider, released alarming statistics regarding the exposure of enterprise environments. According to their research, approximately 60% of organizations using WordPress had at least one vulnerable instance at the time the CVEs were published. More concerningly, 25% of those organizations were exposing these vulnerable servers directly to the internet without the protection of a Web Application Firewall (WAF) or other mitigating controls.

Jake Knott, principal security researcher at watchTowr, noted that the impact is not limited to small blogs. "We are seeing widespread impact across organizations of every size and every vertical," Knott stated. His firm’s honeypots have registered tens of thousands of exploitation attempts in a matter of days, suggesting that threat actors are using automated tools to identify and compromise targets indiscriminately.

Post-Exploitation Tactics and the "CMSmap" Web Shell

Once an attacker successfully exploits the wp2shell chain, their primary objective is to maintain persistence. Researchers have observed a common pattern of post-exploitation activity designed to ensure long-term access even if the initial vulnerability is patched.

One of the most frequent tactics involves the deployment of a 150 KB web shell. To evade detection by site administrators, this shell is often disguised as a legitimate security plugin named "CMSmap." Far from being a security tool, this malicious plugin serves as a comprehensive attack platform. It supports a wide array of functions, including:

• Full file system management (uploading, deleting, and editing files).
• Direct database access and manipulation.
• Internal port scanning to identify other vulnerable systems on the network.
• Batch code injection for infecting other legitimate files on the server.
• Privilege escalation modules, including the exploitation of MySQL User-Defined Functions (UDF).

In addition to web shells, attackers have been observed creating "backdoor" administrator accounts. More than 100 such accounts have been identified across various compromised environments. These accounts allow attackers to log in through the standard WordPress dashboard to install further malware. In several instances, researchers detected attempts to deploy the Overlord RAT, a remote access trojan written in the Golang programming language, which allows for persistent, low-level control over the underlying server OS.

Official Responses and Mitigation Strategies

The WordPress core security team has been working urgently to release patches and auto-updates for affected versions. However, the sheer number of installations worldwide means that manual intervention is often required for custom or legacy environments.

Ben Marr, a security engineer at Intruder, emphasized the danger of the "route confusion" aspect of the flaw. "This flaw arises from improper sanitization… allowing crafted input to alter a database query," Marr explained. He advised that organizations should not only patch but also review their REST API logs for any unusual batch requests that returned a 200 OK status from unauthenticated IP addresses.

Cloudflare has implemented emergency WAF rules for its customers to block the specific patterns associated with the author__not_in SQL injection. They noted that while these rules provide a vital layer of defense, they are not a substitute for updating the WordPress core. Furthermore, they highlighted that enabling a persistent object cache can mitigate the RCE portion of the exploit, though the SQL injection risk remains until the site is fully patched.

Industry Analysis: The Role of AI in Vulnerability Discovery

The wp2shell incident marks a significant milestone in the evolution of cybersecurity: the use of advanced AI to discover critical "zero-day" vulnerabilities in widely used software. Searchlight Cyber’s use of GPT 5.6 Sol to find the flaw in 10 hours demonstrates that the barrier to finding high-impact vulnerabilities is lowering.

This shift presents a dual-edged sword. While legitimate researchers can use AI to harden software, threat actors can equally use these models to find exploits before patches can be developed. The "arms race" between AI-driven discovery and AI-driven defense is no longer a theoretical concern but a present reality. The fact that wp2shell requires "no preconditions" and works on a "stock install" suggests that even the most well-maintained systems are at risk when core logic is flawed.

Recommendations for Website Administrators

Security professionals recommend a multi-tiered approach to rooting out the threat and securing WordPress installations:

1. Immediate Patching: Update WordPress core to the latest version immediately. Ensure that all security auto-updates are enabled.
2. Audit Administrator Accounts: Inspect the "Users" list in the WordPress dashboard for any unrecognized accounts. Pay close attention to accounts created within the last 72 hours.
3. Plugin Review: Check the /wp-content/plugins/ directory for any suspicious folders, particularly those named "CMSmap" or other generic security-sounding names that were not intentionally installed.
4. Log Analysis: Review web server access logs for requests involving wp-json/batch and the author__not_in string. High volumes of these requests from foreign IP addresses are a strong indicator of an attempted or successful compromise.
5. File Integrity Monitoring: Use tools to check if core WordPress files have been modified. Attackers often inject malicious code into wp-config.php or functions.php.

As the exploitation of CVE-2026-63030 and CVE-2026-60137 continues to escalate, the wp2shell event serves as a stark reminder of the vulnerabilities inherent in the infrastructure of the modern web. The combination of core software flaws and automated exploitation requires a proactive, rather than reactive, security posture from all stakeholders.