WordPress Core 'batch/v1' REST API Unauthenticated SQLi (WP2Shell) (Direct Check)

critical Nessus Plugin ID 333313

Synopsis

The WordPress application running on the remote web server is affected by an unauthenticated SQL injection vulnerability.

Description

The version of WordPress running on the remote web server is affected by an unauthenticated SQL injection vulnerability dubbed 'WP2Shell'. The core REST API batch controller ('/wp-json/batch/v1', also reachable via '?rest_route=/batch/v1') improperly sanitizes the 'author_exclude' parameter of the '/wp/v2/users' route when requests are nested inside a batch envelope. A remote, unauthenticated attacker can inject arbitrary SQL into the backend database query, leading to disclosure or manipulation of arbitrary data and, when chained further, to remote code execution on a default WordPress installation with no plugins required.

Nessus confirmed the flaw non-destructively by injecting a time-based blind payload and observing the resulting delay in the server's response. No data was modified and no operating system commands were executed on the target.

Solution

Upgrade to WordPress version 6.9.5 / 7.0.2 or later.

Plugin Details

Severity: Critical

ID: 333313

File Name: wordpress_wp2shell_rce.nbin

Version: 1.1

Type: Remote

Family: CGI abuses

Published: 8/7/2026

Updated: 8/7/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.5

Percentile: 98.39

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-63030

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:wordpress:wordpress

Required KB Items: installed_sw/WordPress, www/PHP

Exploited by Nessus: true

Patch Publication Date: 7/17/2026

Vulnerability Publication Date: 7/17/2026

Reference Information

CVE: CVE-2026-63030

CWE: 89

IAVA: 2026-A-0736

Detections

Analytics