WordPress Core SQL Injection and Pre-Authentication Remote Code Execution Vulnerabilities
WordPress Core contains two vulnerabilities that can be chained together to enable unauthenticated remote code execution on default WordPress installations. CVE-2026-60137 is a SQL injection vulnerability in WP_Query that improperly sanitizes the author__not_in parameter, while CVE-2026-63030 is a REST API batch endpoint route confusion vulnerability. Individually, CVE-2026-60137 has a CVSS score of 5.9 (Medium), but when chained with CVE-2026-63030, the attack achieves unauthenticated remote code execution with a CVSS score of 9.8 (Critical). At the time of publication, public proof-of-concept code is available, and organizations should patch affected systems immediately.
Technical Details
CVE-2026-60137 affects the WP_Query component of WordPress Core. The author__not_in parameter is not properly sanitized, allowing SQL injection when untrusted input reaches the query. On its own, the vulnerability allows an attacker to read data from the WordPress database when attacker-controlled input can reach the vulnerable parameter.
CVE-2026-63030 affects the WordPress REST API batch endpoint. The route confusion flaw allows crafted unauthenticated requests to bypass intended route validation. When combined with CVE-2026-60137, the vulnerability chain, commonly referred to as wp2shell, enables unauthenticated remote code execution against default WordPress installations without requiring plugins or prior authentication.
The remote code execution chain affects WordPress 6.9.x and 7.0.x prior to the patched releases. WordPress 6.8.x is affected by the SQL injection vulnerability but is not vulnerable to the complete pre-authentication RCE chain.
Stop Guessing, Start Proving
NodeZero® Proactive Security Platform — Rapid Response
A NodeZero Rapid Response test has been developed to safely validate whether this vulnerability chain can be exploited in your environment. The test executes real attack techniques without causing damage, giving teams immediate clarity on exposure.
- Run the Rapid Response test: Launch the test from the NodeZero platform to determine whether your WordPress instances are vulnerable to the wp2shell attack chain.
- Patch immediately: Upgrade to a fixed version or implement the vendor’s recommended mitigations.
- Re-run the test: Confirm the vulnerabilities are no longer exploitable after remediation.
Affected versions & patch
Affected
CVE-2026-60137 (SQL Injection)
- WordPress 6.8.0 through 6.8.5
- WordPress 6.9.0 through 6.9.4
- WordPress 7.0.0 through 7.0.1
CVE-2026-63030 (REST API Route Confusion / RCE Chain)
- WordPress 6.9.0 through 6.9.4
- WordPress 7.0.0 through 7.0.1
Fixed
- WordPress 6.8.6
- WordPress 6.9.5
- WordPress 7.0.2
Mitigations
- Upgrade immediately to the appropriate patched release.
- Verify that automatic updates completed successfully rather than assuming they were applied.
- If immediate patching is not possible, block unauthenticated access to the REST API batch endpoint by filtering:
/wp-json/batch/v1rest_route=/batch/v1
- Consider temporarily disabling unauthenticated REST API access where operationally feasible, recognizing that this may affect legitimate integrations.
Timeline
- July 17, 2026: WordPress released versions 6.8.6, 6.9.5, and 7.0.2 addressing the vulnerabilities and enabled forced automatic updates.
- July 17, 2026: CVE-2026-60137 and CVE-2026-63030 were published in the CVE/NVD databases.
- July 17, 2026: Public technical details describing the wp2shell attack chain were released.
- July 19, 2026: Public proof-of-concept exploit code became available.
- July 20, 2026: Horizon3.ai released a NodeZero Rapid Response test for CVE-2026-60137 and CVE-2026-63030.
