WP2Shell Attack Chain: Critical WordPress Vulnerabilities Expose Millions of Websites to Remote Takeover

Introduction: A Perfect Storm in WordPress Core

In what security researchers are calling one of the most severe WordPress vulnerabilities in recent history, two critical flaws in WordPress core have been weaponized into a devastating attack chain dubbed "WP2Shell." Within just three days of disclosure, threat actors launched mass exploitation campaigns targeting millions of WordPress installations worldwide.

The vulnerability chain combines CVE-2026-63030, a REST API batch endpoint logic flaw, with CVE-2026-60137, a SQL injection vulnerability, allowing unauthenticated attackers to achieve complete remote code execution on default WordPress installations—no plugins or special configurations required.

Understanding the WP2Shell Attack Chain

The Two-Vulnerability Combination

WP2Shell exploits a fundamental weakness in how WordPress processes batch API requests. CVE-2026-63030 stems from a route confusion bug in the batch REST endpoint (/wp-json/batch/v1), where validation and execution loops become desynchronized when parsing fails on a sub-request. This array misalignment causes subsequent requests to execute under incorrect handlers, bypassing authentication checks entirely.

CVE-2026-60137, the second piece of the puzzle, is a SQL injection vulnerability in WordPress's WP_Query layer, specifically in the author__not_in parameter. Normally, this vulnerability would require authentication to exploit, but when chained with the batch endpoint flaw, attackers can inject malicious SQL queries without any credentials.

From Vulnerability to Full Compromise

The attack progression follows a methodical path:

Initial Scanning Phase: Attackers conduct mass scans of internet-facing WordPress sites, probing for the vulnerable batch endpoint
Exploitation: Using automated scripts, attackers trigger the route confusion bug and inject SQL commands
Privilege Escalation: Through object hydration and WordPress internals manipulation, attackers create rogue administrator accounts (often prefixed with w2s_)
Code Execution: With admin access secured, attackers upload malicious plugins and deploy PHP webshells for persistent remote access

Affected Versions and Scope

The vulnerability affects a staggering number of installations:

WordPress 6.9.0 through 6.9.4 (Fixed in 6.9.5)
WordPress 7.0.0 through 7.0.1 (Fixed in 7.0.2)
WordPress 6.8.5 and earlier versions are NOT affected

According to Censys internet scan data as of July 20, 2026, the exposed population is measurable—and large:

~62.8 million WordPress instances observed globally
~7.74 million version-visible instances in the full WP2Shell RCE chain range (6.9.x / 7.0.x)—about 12% of all observed WordPress instances
~8.60 million in the broader SQL injection–affected range (also including 6.8.x)—about 14%
Only about 25% of instances expose a version tag, so the true number of vulnerable sites is likely higher
The largest single cluster: WordPress 7.0.1 alone accounted for roughly 5.11 million instances

Active Exploitation in the Wild

The speed of exploitation has been unprecedented. CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog on July 21, 2026—just four days after disclosure and before public proof-of-concept code was widely available.

Bitdefender's Managed Detection and Response (MDR) team documented real-world attacks showing interesting patterns: in one investigated incident, attackers made three separate attempts before achieving full compromise. The first two attempts successfully created administrator accounts but stalled before deploying webshells. The third attempt completed the full chain, uploading malicious plugin droppers and establishing persistent access.

WatchTowr's honeypot network recorded tens of thousands of exploitation attempts within days, identifying over 100 backdoor administrator accounts created by different threat actors. Researchers observed attackers deploying various payloads, including attempts to download "Overlord RAT," a Golang-based remote access trojan.

The AI Factor: GPT-5.6 and Vulnerability Discovery

In a revealing development, Searchlight Cyber researchers disclosed that they discovered the WP2Shell chain with assistance from GPT-5.6 Sol Ultra AI model, completing the entire attack chain development in approximately ten hours. Lead researcher Adam Kues stated: "Without AI assistance, no security researcher could have found and completed this attack chain in ten hours."

This revelation raises important questions about the future of vulnerability research and the arms race between defenders and attackers, as AI tools become increasingly capable of identifying complex exploit chains.

Immediate Action Required: Mitigation Steps

Update Immediately

WordPress has released security patches and enabled forced automatic updates for affected installations:

Update to WordPress 6.9.5 or later (for 6.9.x branch)
Update to WordPress 7.0.2 or later (for 7.0.x branch)

Temporary Mitigation (If Immediate Patching Isn't Possible)

Block anonymous access to the batch endpoint at your web application firewall:

Block /wp-json/batch/v1
Block ?rest_route=/batch/v1

Investigate for Compromise

Even after patching, organizations should:

Review HTTP access logs for suspicious batch endpoint requests
Check for unauthorized administrator accounts, especially those with w2s_ or similar prefixes
Scan for unfamiliar plugins or PHP files in your WordPress installation
Look for recently modified files in wp-content/plugins/ and wp-content/uploads/ directories

Long-Term Security Recommendations

Enable Automatic Updates: Ensure WordPress automatic updates are enabled for core, themes, and plugins
Implement Web Application Firewall (WAF): Deploy WAF rules to detect and block common attack patterns
Regular Security Audits: Conduct periodic vulnerability assessments of your WordPress installations
Principle of Least Privilege: Limit administrator accounts and regularly audit user permissions
Monitoring and Logging: Implement comprehensive logging and monitoring for suspicious activities

Conclusion: A Wake-Up Call for WordPress Security

The WP2Shell attack chain represents a critical reminder that even the most widely-used platforms can harbor severe vulnerabilities in their core code. With a combined CVSS score of 9.8 out of 10, this vulnerability chain demonstrates how multiple seemingly moderate flaws can combine into a catastrophic security failure.

The rapid exploitation timeline—from disclosure to mass attacks in just 72 hours—underscores the importance of immediate patch deployment and proactive security monitoring. Organizations running WordPress must treat this as a critical priority and verify that all installations have been updated to secure versions.

As AI-assisted vulnerability research evolves, both defenders and attackers will gain new capabilities. The race to patch will only become more urgent, making automated security updates and robust monitoring essential components of any WordPress security strategy.

Stay in the loop

Keep up to date with the latest news and updates