New WordPress Flaw Lets Hackers Take Over Websites Through File Uploads
WordPress recently patched a critical vulnerability chain nicknamed wp2shell that allows completely unauthenticated attackers to execute code on vulnerable sites. The flaw affects WordPress versions 6.9 and 7.0, released less than eight months ago, and works on default installations with no plugins required. WordPress pushed emergency patches on Friday and enabled forced automatic updates to contain the threat. The vulnerability consists of two separate bugs: CVE-2026-63030, a REST API batch-route confusion issue, and CVE-2026-60137, a SQL injection flaw. When chained together, these vulnerabilities let anonymous attackers bypass authentication and reach remote code execution. Both the full exploit method and working proof-of-concept code are now publicly available on GitHub.
The technical details reveal how the attack works. The SQL injection exists in the author__not_in parameter of WP_Query, where passing a string instead of an array causes the raw value to go directly into database queries. The batch endpoint confusion allows attackers to reach this vulnerable parameter without authentication by exploiting a flaw in how WordPress processes multiple API requests simultaneously. When sub-requests error, arrays can fall out of sync, causing one request to run under another request's handler and bypassing security checks. While the SQL injection affects WordPress back to version 6.8, the batch-route confusion only exists from 6.9 onward, which is why only recent versions face the full remote code execution risk.
The vulnerability has some important limitations that reduce but do not eliminate the danger. Sites using persistent object caching solutions like Redis or Memcached appear protected from the code execution path, though they remain vulnerable to the underlying SQL injection. However, default WordPress installations do not include persistent caching, leaving hundreds of millions of potentially vulnerable sites exposed. WordPress labeled the chain as Critical in its advisory, though the official CVE scoring rates it at 7.5, which is only High severity. This discrepancy occurs because the scoring methodology treats the route confusion as a parsing error rather than recognizing the full impact of the chained exploitation leading to code execution.
The disclosure timeline highlights the challenge of responsible vulnerability management in open source software. Researchers initially held back detailed write-ups while WordPress deployed patches, but because WordPress is open source, other security researchers quickly reverse-engineered the vulnerability by examining the patched code. Within a day of the patch release, full technical details and working exploits appeared online. Site administrators should verify their WordPress version immediately rather than assuming automatic updates succeeded, especially if they disabled auto-updates. Given that mass exploitation of WordPress vulnerabilities is well-established and this flaw works on default configurations, the race between patch deployment and attacker exploitation will determine the ultimate impact of this vulnerability.
Stay secure — stay Wavasec. 🔐
