🚨 Critical Security Alert: The “wp2shell” Exploit Chain Threatens WordPress Core

A devastating vulnerability chain has emerged within the core architecture of WordPress, sending shockwaves through the siber security ecosystem. Dubbed wp2shell, this exploit chain links two critical flaws — CVE-2026–63030 and CVE-2026–60137 — enabling completely unauthenticated, remote attackers to execute arbitrary code (RCE) on default installations. Because this vulnerability targets native components, it requires zero third-party plugins or active themes to succeed, putting millions of applications at immediate risk.

The exploit chain operates by exploiting a severe logic flaw inside the WordPress REST API batch request handler (/wp-json/batch/v1). Known as Batch-Route Confusion, this flaw forces the application's internal array parsing loops to lose synchronization when processing structurally anomalous JSON payloads. This architectural drift allows an anonymous attacker to bypass access gates entirely, tricking the server into running highly privileged internal endpoints using the lax permission checks intended for public routes.

Once inside, the attacker leverages the authorization bypass to reach deeper database abstractions via the WP_Query engine. Due to an absence of strict input validation on parameters like author__not_in, the smuggled traffic easily transitions into a Time-Based or UNION-Based Blind SQL Injection. This allows attackers to silently exfiltrate database records—specifically administrative password hashes and cryptographic session salts—leading directly to full administrative session takeover and host compromise.

Defending against this critical 9.8 CVSS threat requires immediate action. While automated background updates were pushed for versions 6.9.5 and 7.0.2, configuration issues or aggressive caching layers frequently block these patches from completing successfully.

Read the Full Technical Breakdown

To see the complete analysis, step-by-step exploit chain mechanics, structured query examples, and comprehensive WAF virtual patching strategies, read the full publication on my website:

👉 https://denizhalil.com/2026/07/20/wordpress-cve-2026-63030-batch-route-confusion/