Overview
Recently, NSFOCUS CERT detected that WordPress issued a security bulletin to fix the WordPress remote code execution vulnerability (CVE-2026-63030/CVE-2026-60137), known as wp2shell; Unauthenticated attackers can bypass authentication through REST API batch requests, use SQL injection to obtain administrator password hashes, and use plug-in installation functions to implant WebShell to achieve remote code execution. The CVSS score is 9.8. At present, the vulnerability details and PoC have been made public, and wild exploitation has been found. Relevant users are requested to take measures to protect themselves as soon as possible.
CVE-2026-63030: Due to batch routing obfuscation when the REST API Batch interface processes multiple subrequests, attackers can bypass some whitelist request restrictions and distribute specially crafted requests to error handling logic.
CVE-2026-60137: Due to a flaw in the author__not_in parameter of WP_Query for type checking, an attacker can perform Boolean or temporal SQL injections to read sensitive information from the database.
Reference links:
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
Scope of Impact
- 7.0.0 <= WordPress < 7.0.2
- 6.9.0 <= WordPress < 6.9.5
- 6.8.0 <= WordPress < 6.8.6 (affects CVE-2026-60137 only)
Unaffected versions
- WordPress >= 7.0.2
- WordPress >= 6.9.5
- WordPress >= 6.8.6
Detection
Relevant users can use the following command to determine whether the current version of WordPress is a security risk:
| wp core version |
Mitigation
Official upgrade
At present, the official has released a new version to fix this vulnerability. Affected users are requested to upgrade the version as soon as possible for protection. Download link: https://wordpress.org/download
Note: WordPress has pushed security updates to affected versions through a forced automatic update mechanism; relevant users can also use the WordPress backend: Dashboard → Update → Update Now.
Other protective measures
If the relevant users are temporarily unable to perform upgrade operations, the following measures can also be used for temporary protection:
- Install the “Disable WP REST API” plugin to prevent anonymous users from accessing the WordPress REST Batch API
- Without affecting the business, use security equipment to intercept /wp-json/batch/v1 and? rest_route=/batch/v1
- Deployment of custom plug-ins requires that REST batch requests must be authenticated, and intercepts requests for REST API batch endpoints through middleware configuration
Statement
This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.
About NSFOCUS
NSFOCUS, a pioneering leader in cybersecurity, is dedicated to safeguarding telecommunications, Internet service providers, hosting providers, and enterprises from sophisticated cyberattacks.
Founded in 2000, NSFOCUS operates globally with over 3000 employees at two headquarters in Beijing, China, and Santa Clara, CA, USA, and over 50 offices worldwide. It has a proven track record of protecting over 25% of the Fortune Global 500 companies, including four of the five largest banks and six of the world’s top ten telecommunications companies.
Leveraging technical prowess and innovation, NSFOCUS delivers a comprehensive suite of security solutions, including the Intelligent Security Operations Platform (ISOP) for modern SOC, DDoS Protection, Continuous Threat Exposure Management (CTEM) Service and Web Application and API Protection (WAAP). All the solutions and services are augmented by the Security Large Language Model (SecLLM), ML, patented algorithms and other cutting-edge research achievements developed by NSFOCUS.
