'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover
A newly discovered exploit chain, dubbed ‘WP2Shell,’ is rapidly being used to compromise millions of WordPress sites. Attackers are chaining together a SQL injection vulnerability (CVE-2026-60137) and a logic flaw in the WordPress Batch REST API (CVE-2026-63030) to achieve unauthenticated remote code execution. The ease of exploitation, aided by readily available proof-of-concept code and AI assistance, has led to a surge in attack attempts, with threat actors deploying backdoors and attempting to exfiltrate credentials. WordPress has enabled forced updates to mitigate the risk.
A rapidly spreading exploit chain, ‘WP2Shell,’ is targeting millions of WordPress sites, leveraging a combination of vulnerabilities to achieve unauthenticated remote code execution. The attack chain combines a SQL injection vulnerability (CVE-2026-60137) in WordPress Core with a logic flaw in the WordPress Batch REST API (CVE-2026-63030). The flaw in the Batch API allows attackers to bundle multiple requests into one, bypassing validation checks and enabling malicious requests to be executed.
Researchers at Searchlight Cyber, utilizing AI assistance (GPT-5.6 Sol Ultra), discovered and developed the exploit chain in just 10 hours, highlighting the potential of AI in vulnerability research and exploitation. The ease of reproduction, with readily available proof-of-concept exploits and the speed with which AI could generate them, has fueled a massive increase in attack attempts.
WordPress versions 6.9.0 - 6.9.4 and 7.0.0 - 7.0.1 are affected. Due to the severity, WordPress has enabled forced updates via its auto-update system for sites running affected versions. Vulnerabilities are being exploited using public exploit code, with threat actors deploying fake WordPress plugins to gain Remote Code Execution, exfiltrate credentials, or download additional tooling. WatchTower’s Jake Knott reported that his honeypot network recorded tens of thousands of exploitation attempts and over 100 backdoor accounts created by different threat actors within two days of the initial disclosure.
Patrick Munch, chief security officer at Mondoo, emphasizes the attractiveness of WP2Shell due to its ability to bypass traditional defenses: “SQLi on its own gets you into the WordPress database. RCE gets you the whole server.” The combination of vulnerabilities allows attackers to skip steps typically required to compromise a system, making exploitation a simple, script-based process.
WordPress has enabled forced updates to mitigate the risk, and researchers advise users to update immediately to avoid exploitation.