CVE-2026-63030 and CVE-2026-60137 form the wp2shell pre-auth RCE chain in WordPress Core. Exploitation confirmed. Patches in WordPress 7.0.2 and 6.9.5.

wp2shell: WordPress Core Pre-Auth RCE FAQ | Tenable®

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Two WordPress Core vulnerabilities could be chained together to gain remote code execution. Public exploits are available and exploitation has been observed. Upgrade ASAP.

The version of WordPress running on the remote web server is affected by an unauthenticated SQL injection vulnerability dubbed 'WP2Shell'. The core REST API batch controller ('/wp-json/batch/v1', also reachable via '?rest_route=/batch/v1') improperly sanitizes the 'author_exclude' parameter of the '/wp/v2/users' route when requests are nested inside a batch envelope. A remote, unauthenticated attacker can inject arbitrary SQL into the backend database query, leading to disclosure or manipulation of arbitrary data and, when chained further, to remote code execution on a default WordPress installation with no plugins required.

Nessus confirmed the flaw non-destructively by injecting a time-based blind payload and observing the resulting delay in the server's response. No data was modified and no operating system commands were executed on the target.

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

- A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

- Facilitated SQL injection vulnerability in the `author__not_in` parameter of `WP_Query`

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

WordPress versions 6.9.x < 6.9.5 and 7.0.x < 7.0.2 are vulnerable to a REST API batch-route confusion weakness, which combined with an SQL injection issue leads to Remote Code Execution.

WordPress versions 7.0 < 7.0.2 are affected by one or more vulnerabilities

ID	Name	Product	Family	Severity
333313	WordPress Core 'batch/v1' REST API Unauthenticated SQLi (WP2Shell) (Direct Check)	Nessus	CGI abuses	critical
115317	WordPress 7.0.x < 7.0.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115316	WordPress 6.9.x < 6.9.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115315	WordPress 6.9.x < 6.9.5 / 7.0.x < 7.0.2 SQL Injection (wp2shell)	Web App Scanning	Component Vulnerability	critical
327666	WordPress 7.0 < 7.0.2	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2026-63030

high

Tenable Plugins

critical

critical

critical

critical

critical