ADVISORY SUMMARY
CISA added CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection in WP_Query) to the KEV catalog on July 21, 2026, confirming active in-the-wild exploitation of the 'wp2shell' chain. Chained together, an unauthenticated attacker achieves full RCE on any default WordPress 6.9.0–6.9.4 or 7.0.0–7.0.1 installation with no plugins required; public PoC exploits are circulating and WordPress.org force-pushed the fix via auto-update.
AFFECTED SYSTEMS
MITIGATION GUIDANCE
Update to WordPress 7.0.2, 6.9.5, or 6.8.6 immediately. Verify auto-updates completed successfully — do not assume the forced push succeeded. Implement a WAF rule blocking crafted POST requests to /wp-json/batch/v1 and /wp/v2/posts with the author__not_in parameter as a temporary compensating control.
DETECTION SIGNATURES
Review HTTP access logs for requests to /wp-json/batch/v1 with unusual sub-request paths or unexpected status codes. Look for requests to /wp/v2/posts containing SQL metacharacters in the author__not_in query parameter. Monitor for new PHP files created under wp-content directories post-exploitation. Alert on unexpected outbound connections from webserver processes.
REFERENCES
- → https://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog
- → https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/
- → https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
- → https://nvd.nist.gov/vuln/detail/CVE-2026-63030