Ethical Hacking News
A critical vulnerability has been discovered in WordPress sites using newly released "wp2shell" exploits. These attacks can be chained together to gain remote code execution without authentication, posing a significant risk to over 500 million websites that use WordPress. It is essential for site owners and administrators to take immediate action to patch their sites or implement temporary measures to reduce risk until an update is available.
Two critical WordPress vulnerabilities (CVE-2026-63030 and CVE-2026-60137) have been discovered, tracked as REST API batch-route confusion bug and high-severity SQL injection flaw. These vulnerabilities can be chained together to achieve pre-authentication remote code execution on default WordPress installations running versions 6.9.x and 7.0.x. Over 500 million websites use WordPress, making them a significant target for the wp2shell attack chain. Site owners are advised to update immediately to WordPress 7.0.2 or 6.9.5 to prevent exploitation. Administrators can temporarily reduce risk by blocking anonymous access to the REST API batch endpoint through a security plugin or WAF rules.
The world of cybersecurity is constantly evolving, and recent discoveries have shed light on a growing threat to website security: the exploitation of vulnerabilities in WordPress sites using newly released "wp2shell" exploits. These attacks pose a significant risk to individuals and organizations alike, as they can be chained together to gain remote code execution without authentication.
According to Searchlight Cyber's security research team, two critical WordPress flaws have been discovered, tracked as CVE-2026-63030 and CVE-2026-60137. The first vulnerability, CVE-2026-63030, is a REST API batch-route confusion bug introduced in WordPress 6.9, while the second vulnerability, CVE-2026-60137, is a high-severity SQL injection flaw affecting the author__not_in parameter of WP_Query.
These vulnerabilities can be chained together to achieve pre-authentication remote code execution on default WordPress installations running versions 6.9.x and 7.0.x. This means that an attacker with minimal privileges can exploit these vulnerabilities to gain control over a website without needing valid credentials.
The consequences of this attack are far-reaching, as it is estimated that over 500 million websites use WordPress. Furthermore, researchers have released an online tool to help administrators check whether their WordPress instances are vulnerable, and WordPress has enabled forced automatic security updates for affected supported versions due to the severity of the flaws.
In light of these vulnerabilities, site owners are advised to update immediately to WordPress 7.0.2 or 6.9.5, which prevent the exploitation of the wp2shell attack chain. However, for those who cannot patch their sites, administrators can temporarily reduce risk by blocking anonymous access to the REST API batch endpoint through a security plugin or WAF rules targeting /wp-json/batch/v1 and ?rest_route=/batch/v1.
While this is just one example of how rapidly evolving vulnerabilities are becoming more prevalent in our digital landscape. The key takeaway here is that website owners, administrators, and individuals must remain vigilant about the latest exploits and updates to protect their digital assets from harm.
Related Information:
https://www.ethicalhackingnews.com/articles/Exploiting-Vulnerabilities-The-Growing-Threat-of-WordPress-wp2shell-Attacks-ehn.shtml
https://securityaffairs.com/195597/hacking/attackers-can-take-over-wordpress-sites-using-newly-released-wp2shell-exploits.html
https://nvd.nist.gov/vuln/detail/CVE-2026-63030
https://www.cvedetails.com/cve/CVE-2026-63030/
https://nvd.nist.gov/vuln/detail/CVE-2026-60137
https://www.cvedetails.com/cve/CVE-2026-60137/
Published: Sun Jul 19 00:56:39 2026 by llama3.2 3B Q4_K_M
