OFFSITE.DARK
← Signals

Jul 17, 2026

3 min

Sploitus

  • wordpress
  • sqli
  • rce
  • cve
  • rest-api
  • cisa-kev
  • pre-auth

news

WP2Shell: WordPress REST Batch SQLi to RCE (CVE-2026-63030)

Unauthenticated REST batch route confusion yields SQLi and optional admin→plugin RCE; CISA KEV, Rapid Escalation scanning, public checkers indexed on Sploitus.

Summary

CVE-2026-63030 (“WP2Shell”) is a critical WordPress core chain: an unauthenticated SQL injection reached through REST batch route confusion on POST /wp-json/batch/v1, with optional post-exploitation to administrator and plugin-upload remote code execution. NVD published the CVE on 2026-07-17. CrowdSec observed in-the-wild exploitation from 2026-07-20, and CISA added the flaw to KEV on 2026-07-21 (federal remediation deadline 2026-07-24).

Independent checkers and PoC tooling appear in Sploitus’s exploits-of-the-week list (e.g. wp2shell index). Elastic Security Labs and Eye Security published defender-facing detection guidance.

OFFSITE.DARK indexes public advisories and Sploitus listings only; we did not discover or weaponize this flaw.

Technical Details

AspectDetail
CVECVE-2026-63030
ComponentWordPress REST API — /batch/v1 nested-batch / route dispatch
Root causeBatch handler array desync under nested/malformed routes (route confusion) exposing posts query paths with attacker-influenced SQL parameters (e.g. author_exclude)
AuthNone for SQLi; RCE via credential recovery / plugin upload is post-exploitation
FixedWordPress 6.9.5 (6.9.x) and 7.0.2 (7.0.x)
KEVYes — CISA KEV 2026-07-21

Public checkers typically separate:

  1. check — non-destructive marker probe for batch route confusion (HTTP 207 + characteristic error tokens).
  2. read — database read via UNION / error / blind techniques.
  3. shell — optional admin login + plugin upload (or SQLi-to-admin bridge in some tools).

Treat full RCE demos as impact proof, not the core vulnerability.

CVE

FieldValue
CVECVE-2026-63030
CWECWE-89 (SQL Injection) among related issues
CVSSCritical (industry reporting up to ~9.8 for full chain)
StatusPatched in 6.9.5 / 7.0.2; actively exploited; CISA KEV

Impact

  • Unauthenticated database disclosure (users, password hashes, options).
  • Site takeover when hashes are cracked or when tooling bridges to admin + plugin install.
  • Mass scanning: CrowdSec labeled exploitation Rapid Escalation within days of first detection.

Highest risk: internet-facing WordPress on 6.9.0–6.9.4 or 7.0.0–7.0.1 without WAF rules blocking /batch/v1.

Mitigation

  1. Upgrade to WordPress 6.9.5 or 7.0.2 (or later) immediately.
  2. Until patched, block /wp-json/batch/v1 and rest_route=/batch/v1 at the edge, or require auth via rest_pre_dispatch.
  3. Hunt for anomalous batch REST traffic, new admin users, and unexpected plugin uploads since mid-July 2026.
  4. Rotate credentials if the site was unpatched while internet-facing.
  5. Follow Elastic / Eye Security detection notes for WAF and EDR coverage.

Sources

→ Source