Critical “wp2shell” REST API Route Confusion and SQL Injection Vulnerabilities in WordPress Core
Severity | CRITICAL (CVSS 10.0) |
| Threat Category | Vulnerability / Remote Code Execution (RCE) |
| Affected Platforms | WordPress Core running branches 6.8.0 to 6.8.5 (SQL injection) and branches 6.9.0 to 6.9.4 & 7.0.0 to 7.0.1 (Route confusion/RCE) |
| CVE Reference | CVE-2026-63030 (REST API Route-Confusion) and CVE-2026-60137 (SQL Injection) |
| Current Status | Actively exploited in the wild. Automated proof-of-concept (PoC) tools are publicly circulating on GitHub. |
1. Overview
The Bhutan Computer Incident Response Team (BtCIRT) is issuing this urgent security advisory to alert government agencies, private sector businesses, and the general public in Bhutan to a critical vulnerability in WordPress Core, designated as wp2shell. This vulnerability poses an immediate threat of Remote Code Execution (RCE) on servers running vulnerable versions of WordPress Core.
This advisory is based on corroborated reporting and analysis from the following sources:
- WordPress Security Team / Vendor — Disclosed a critical security release (WordPress 7.0.2) on July 29, 2026, which contains patches for the active route-confusion and SQL injection flaws.
- Elastic Security Labs — Disclosed technical threat intelligence and detection frameworks for the “wp2shell” RCE flaw, highlighting that the vulnerability is actively being exploited in the wild.
The core threat revolves around an unauthenticated Remote Code Execution (RCE) vulnerability. By exploiting route confusion and SQL injection primitives within the WordPress REST batch endpoint used to handle bundled sub-requests, remote attackers can execute arbitrary code on hosting environments and achieve complete compromise of affected web servers without requiring credentials or user interaction.
2. Who is Affected
At the time of issuing this advisory, BtCIRT has not received any confirmed local reports of systems within Bhutan being compromised by the “wp2shell” exploit. However, the risk to organizations and individuals across Bhutan is assessed as immediate and extreme due to the following critical exposure factors:
- Widespread deployment of WordPress Core as a primary content management system (CMS) across government, enterprise, and personal websites throughout Bhutan.
- The ease of exploitation, which requires no authentication, no specific third-party plugins, and no user interaction.
- The public availability and active usage of automated proof-of-concept (PoC) exploitation tools circulating on code repositories like GitHub, allowing low-skilled threat actors to scan and compromise targets programmatically.
3. How the Vulnerability Works
The “wp2shell” exploit functions through a sequence of technical phases, progressing from initial target scanning to full remote shell access and host takeover:
Stage 1 — Root Cause and Target Identification: The vulnerability stems from two architectural flaws within the WordPress REST batch endpoint handling bundled sub-requests. Attackers use automated scanners to identify WordPress sites running vulnerable branches, specifically branches 6.8.0 to 6.8.5 (SQL injection exposure) and branches 6.9.0 to 6.9.4 or 7.0.0 to 7.0.1 (route confusion).
Stage 2 — Delivery of Malicious Batch Request: The attacker sends a specially crafted, unauthenticated batch HTTP request to the WordPress REST batch endpoint. This request bundles multiple sub-requests, structured to trigger the routing and query confusion.
Stage 3 — REST API Route Confusion and SQL Injection: Upon processing, the route-confusion primitive (CVE-2026-63030) bypasses WordPress Core’s internal access control lists, tricking the routing engine into invoking sensitive administrative API routes. Concurrently, the SQL injection primitive (CVE-2026-60137) allows the attacker to execute unauthorized database queries to manipulate data or retrieve system variables.
Stage 4 — Remote Code Execution and System Compromise: The combined execution of route confusion and SQL injection enables the attacker to write arbitrary files to the web server’s writable directories. Attackers typically upload web shells (backdoors) to establish persistent administrative access.
Impact: Successful exploitation leads to full, unauthenticated compromise of the underlying hosting server. Attackers can execute arbitrary command-line instructions, modify web content, exfiltrate sensitive databases, access server configuration credentials, or utilize the compromised server to launch secondary internal attacks within the network.
4. Indicators to Watch For
System administrators and security teams should actively monitor for the following concrete indicators of potential targeting or compromise:
- Anomalous REST API Batch Requests: Review web server access logs for unusual POST requests targeting the REST batch endpoint (e.g., requests containing nested sub-requests or abnormal routing parameters).
- Suspicious Database Queries: Look for database log errors or slow query logs indicating SQL injection patterns (such as UNION statements or metadata extraction) originating from REST API sub-requests.
- Unauthorized File Creation: Scan write-permissive directories (such as wp-content/uploads/) for unexpected PHP files, newly created scripts, or web shells containing shell execution commands.
- Anomalous Outbound Network Connections: Detect unexpected outbound server connections initiated by web server processes (e.g., www-data or apache) which may indicate the retrieval of secondary stage exploit payloads or web shell command-and-control (C2) communication.
5. Recommendations
For organizations and government offices:
- Apply Security Patches Immediately: All organizations hosting WordPress installations must immediately update their installations to the latest secure versions released on July 29, 2026:
- WordPress branch 6.8.x installations must be updated to 6.8.6
- WordPress branch 6.9.x installations must be updated to 6.9.5
- WordPress branch 7.0.x installations must be updated to 7.0.2
- Verify Downstream Dependencies: Due to potential downstream plugin and theme dependencies, system administrators must refer to the official vendor’s advisory and the affected host’s documentation to confirm required configuration updates before and after patching.
- Enable Web Application Firewall (WAF) Protections: Implement strict WAF rules to block remote requests targeting the WordPress REST API batch endpoints that show route-confusion or SQL injection characteristics.
- Audit and Restrict REST API Access: If the WordPress REST API batch endpoint is not required for business operations, consider restricting external access to the batch routes.
For individuals (if applicable):
- Enable Automatic Core Updates: Ensure that automatic security updates are enabled in the WordPress administration panel to guarantee rapid deployment of future security releases.
- Manually Verify Version Status: Log in to the administrative dashboard to verify that the active WordPress Core version is running a patched version (6.8.6, 6.9.5, or 7.0.2).
6. Reporting
If you suspect your organization, device or account has been affected by this threat, or observe activity matching this pattern, please report it immediately to BtCIRT at cirt@btcirt.bt.
7. Sources and References
1. Elastic Security Labs Threat Intelligence Report (July 2026): “wp2shell: WordPress Remote Code Execution Detection with Elastic Defend” —
https://www.elastic.co/security-labs/wp2shell-wordpress-rce-detection-elastic-defend
2. WordPress Core Security Team Release Advisory (July 29, 2026): “WordPress 7.0.2 Security Release” —
https://wordpress.org/news/2026/07/wordpress-7-0-2-release/