A critical unauthenticated remote code execution vulnerability chain located inside the absolute baseline core components of a dominant web publishing platform has been exposed in the wild. The bug allows anonymous network reachable actors to send specialized http requests to execute arbitrary system commands on host web servers without requiring valid administrative accounts or third party plugin installations.
The exploit sequence, tracked under the project moniker wp2shell, targets WordPress installations running versions 6.9 and 7.0 configurations. The attack works by chaining two distinct defects within standard application code layers. CVE-2026-63030 facilitates a REST API batch route logic confusion state, which lets anonymous queries bypass validation filters. Once internal filters are bypassed, the attacker passes secondary parameters to exploit CVE-2026-60137, a hidden SQL injection path inside core functions. Because a working proof of concept module has been distributed onto public repository databases, the platform maintainers have initialized an extraordinary forced auto update sweep across all global hosting providers to seal the logic loophole.
Subverting a primary content management web server allows threat groups to establish permanent initial access perimeters inside target enterprises. Because public facing content assets regularly share database environments, internal configuration parameters, and api access credentials with corporate internal networks, an unauthenticated takeover lets adversaries siphon directory hashes, modify active web pages to serve malware files, and execute lateral tunneling loops to penetrate corporate subnets.
– Confirm that your public web hosts have successfully migrated to the emergency secure maintenance builds 6.9.5 or 7.0.2 instantly.
– Implement explicit string filtering policies at your web application firewall tier to intercept and block malformed batch query routes.
– Scan file systems and user asset databases for anomalous file definitions or unrecognized configuration modifications tracing to active templates.
– Enforce rigid database segmentations to keep public web applications fully separated from internal active directory directories.
Web framework security relies on prompt component alignment and active connection filtering to ensure that foundational publishing engines do not serve as unmonitored initial access lines for automated extortion campaigns. #CodeDefence #WordPress #wp2shell #RCE #SQLi #AppSec #VulnerabilityManagement
/
