Pre-authentication remote arbitrary code execution affecting WordPress Core
A vulnerability affecting WordPress would allow an unauthenticated attacker to remotely execute arbitrary code on affected systems.
Description
Technical context and vulnerability details
WordPress is an open-source content management system (CMS) intended for the creation and administration of websites, deployed on a significant proportion of sites worldwide. WordPress Core is affected by a vulnerability, CVE-2026-63030, resulting from a batch-route confusion in the REST API batch endpoint (/wp-json/batch/v1). Linked to an unauthenticated SQL injection labeled CVE-2026-60137, present in the author__not_in parameter of the WP_Query class, this flaw would allow an unauthenticated malicious actor to execute arbitrary code remotely on the server hosting a default WordPress installation. This chain of vulnerabilities is referred to as wp2shell by researchers. It is classified critical with a severity score of 9.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Compromise of system integrity;
- Data privacy breach;
- Breach of data availability;
Affected systems
Products, components and targeted versions
- WordPress versions 6.9.0 to 6.9.4;
- WordPress versions 7.0.0 to 7.0.1;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update WordPress to version 6.9.5, 7.0.2 or later;
- Check that the automatic security update, forced by the publisher, was correctly applied to the installations concerned;
- Failing an immediate fix, restrict or filter access to the /wp-json/batch/v1 endpoint using a web application firewall (WAF);
- Look for possible signs of compromise (files, user accounts or unknown scheduled tasks) on exposed installations;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.