Two WordPress Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, have been linked in an attack chain known as wp2shell. The attack chain and its potential impact were also detailed in a report by The Hacker News .
When chained together, the vulnerabilities can potentially allow an unauthenticated attacker to compromise a vulnerable WordPress installation and achieve remote code execution (RCE).
To help protect servers against exploitation attempts, BitNinja has released three new WAF rules for WAF2 and WAFPro:
- 401007 - CVE-2026-63030
- 401008 - CVE-2026-60137
- 401009 - CVE-2026-60137
These rules add an additional defensive layer by helping identify and block malicious request patterns associated with wp2shell exploitation attempts.
What Is the wp2shell WordPress Vulnerability?
wp2shell is an attack chain involving CVE-2026-63030 and CVE-2026-60137 in WordPress Core. When combined, the vulnerabilities can create a path from an unauthenticated web request to severe compromise, potentially including remote code execution.
CVE-2026-63030: REST API Batch Route Confusion
CVE-2026-63030 affects WordPress REST API batch request handling. In the wp2shell attack chain, the vulnerability can be used to reach functionality that should not normally be accessible to an unauthenticated attacker.
Affected versions include:
- WordPress 6.9.0 through 6.9.4
- WordPress 7.0.0 through 7.0.1
The issue is addressed in WordPress 6.9.5 and 7.0.2.
CVE-2026-60137: SQL Injection in WordPress Core
CVE-2026-60137 is an SQL injection vulnerability in WordPress Core associated with improper handling of query parameters within WP_Query.
Affected versions include:
- WordPress 6.8.0 through 6.8.5
- WordPress 6.9.0 through 6.9.4
- WordPress 7.0.0 through 7.0.1
Security fixes are available in WordPress 6.8.6, 6.9.5, and 7.0.2.
How Does the wp2shell Attack Chain Work?
The main risk comes from chaining the two vulnerabilities together.
- CVE-2026-63030 can be used to abuse REST API request-processing behavior.
- CVE-2026-60137 provides an SQL injection primitive as part of the exploitation chain.
- Successful chaining can potentially lead to deeper compromise, including remote code execution.
Potential impact may include:
- Unauthorized database access
- Credential or password-hash exposure
- Privilege escalation
- Administrative account compromise
- Website takeover
- Remote code execution
BitNinja WAF Protection for wp2shell
BitNinja has released three new Web Application Firewall rules for WAF2 and WAFPro to help block attack patterns associated with the wp2shell vulnerabilities.
| Rule ID | Vulnerability | Availability |
|---|---|---|
| 401007 | CVE-2026-63030 | WAF / WAFPro |
| 401008 | CVE-2026-60137 | WAF / WAFPro |
| 401009 | CVE-2026-60137 | WAF / WAFPro |
By inspecting incoming requests at the WAF layer, malicious patterns can be blocked before they reach vulnerable WordPress application logic.
This is especially important for hosting providers managing large numbers of WordPress installations, where patching every affected site immediately may not always be possible.
How to Protect WordPress Against wp2shell
1. Update WordPress Core
Upgrade affected installations to a patched version:
- WordPress 6.8.x → 6.8.6 or later
- WordPress 6.9.x → 6.9.5 or later
- WordPress 7.0.x → 7.0.2 or later
2. Keep WAF Protection Enabled
WAF protection provides an additional security layer against malicious HTTP requests targeting known web application vulnerabilities.
3. Review Logs and Exposed Systems
Administrators should review access and security logs for suspicious REST API requests, unusual authentication events, unexpected administrator accounts, file modifications, or other indicators of compromise.
Recommended response: patch WordPress, keep WAF protection active, monitor for exploitation attempts, and investigate systems that may have been exposed before remediation.
Frequently Asked Questions About wp2shell
What is wp2shell?
wp2shell is an attack chain involving two WordPress Core vulnerabilities: CVE-2026-63030 and CVE-2026-60137.
Can a WAF protect against wp2shell?
A Web Application Firewall can help block malicious request patterns associated with exploitation attempts. BitNinja has released rules 401007, 401008, and 401009 for WAF and WAFPro to add protection against attacks associated with these vulnerabilities.
Protect WordPress Infrastructure with BitNinja
The wp2shell vulnerabilities highlight how quickly newly disclosed WordPress Core flaws can create risk across hosting environments.
BitNinja's new WAF rules provide an additional defensive layer while administrators identify, update, and investigate affected WordPress installations.
Learn more about BitNinja and strengthen your server protection against emerging web threats.
