A critical remote code execution (RCE) vulnerability chain, dubbed “wp2shell,” has been identified in WordPress Core, potentially exposing over 500 million websites to complete takeover by unauthenticated attackers. This chain combines two vulnerabilities: CVE-2026-63030, a REST API batch-route confusion issue, and CVE-2026-60137, a SQL injection flaw in the `author__not_in` parameter of `WP_Query`. Notably, this exploit affects standard WordPress installations without any plugins, requiring no user interaction or special configurations.
Discovery Through AI-Powered Analysis
Security researcher Adam Kues from Searchlight Cyber’s Assetnote team uncovered this vulnerability using an AI-driven approach. Utilizing OpenAI’s GPT-5.6 Sol Ultra model, Kues directed the AI to analyze the WordPress core codebase for pre-authentication RCE chains. The AI identified a pre-authentication SQL injection vulnerability, which Kues validated by extracting an administrator’s email address from a test instance. Further analysis by the AI led to the development of a complete exploit chain, all achieved with approximately $25 in compute costs.
Technical Breakdown of the ‘wp2shell’ Exploit Chain
The exploit chain begins with a flaw in the WordPress REST API batch endpoint (`/wp-json/batch/v1`), introduced in WordPress 5.6. This feature allows multiple API requests to be bundled into a single call. Under normal circumstances, each REST request undergoes parameter validation, sanitization, a permission check, and execution. However, the batch endpoint’s design permits attackers to bypass these checks by crafting specific payloads, leading to unauthorized access and potential code execution.
Given WordPress’s extensive use across the web, the ‘wp2shell’ vulnerability represents a significant security risk. Website administrators are urged to apply the latest security patches promptly to mitigate potential exploits. This incident underscores the evolving nature of cybersecurity threats and the importance of proactive vulnerability management.
