In a recent discovery within the widely-used WordPress web content management system, two vulnerabilities named wp2shell were found. These vulnerabilities allow for an attacker to gain complete access to the admin panel and execute code with web server privileges by sending an external request without authentication. It is important to note that these vulnerabilities are present within the main WordPress codebase and are not associated with specific themes or plugins. However, for the attack to be successful, the WordPress site must be accessible to external requests. To address these issues, corrective updates were released in versions 6.8.6, 6.9.5, and 7.0.2.
The exploit involves two specific vulnerabilities. The first one, CVE-2026-60137, enables an attacker to perform SQL query substitution without proper authentication due to the lack of sanitization within the “author__not_in” parameter. The second vulnerability, CVE-2026-63030, relates to routing requests in batch mode within the REST API. When combined with SQL query substitution, this vulnerability allows for the execution of unauthorized code on the server.
Reports have already surfaced online indicating that these vulnerabilities are being actively exploited. Attackers are conducting automated mass attacks on WordPress-based sites to introduce backdoors and install malicious plugins. Signs of such attack attempts include the presence of requests such as “/?rest_route=/batch/v1” in the log files and the appearance of files with random names in the “/wp-content/cache/” directory if a webshell is integrated by the attacker. As a security measure, it is recommended to block access through the REST API by blocking “/wp-json/batch/v1” and filtering out requests with the “rest_route=/batch/v1” parameter.