Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Critical Vulnerability Chain in WordPress Core Under Exploitation (wp2shell)

Successful exploitation of CVE-2026-63030 and CVE-2026-60137 could allow an unauthenticated attacker to execute code remotely

Threat ID:
CC-4815
Threat Severity:
High
Published:
20 July 2026 11:35 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Successful exploitation of CVE-2026-63030 and CVE-2026-60137 could allow an unauthenticated attacker to execute code remotely

Threat details

Exploitation of CVE-2026-63030 and CVE-2026-60137 reported

Security researchers have reported exploitation of the wp2shell exploit chain, and a public proof-of-concept exploit is available. The NHS England National CSOC assesses further exploitation as highly likely.

Introduction

Security researchers have disclosed a pre-authentication remote code execution (RCE) vulnerability chain in WordPress Core. 

  • CVE-2026-63030 - Interpretation Conflict vulnerability - CVSSv3 score: 9.8
  • CVE-2026-60137 - SQL Injection vulnerability - CVSSv3 score: 5.9

CVE-2026-63030 and CVE-2026-60137 can be chained together to achieve unauthenticated remote code execution through crafted API requests.

Remediation advice

Affected organisations must review security advisories GHSA-ff9f-jf42-662q and GHSA-fpp7-x2x2-2mjf, and complete the remediation steps detailed below.

Remediation steps

Type Step
Patch

Required: Patch to a fixed version

Affected organisations must patch their WordPress Core instance to a fixed, supported version:

  • version 7.0.2 or later
  • version 7.1 beta2 or later

Note: Patches have been released for WordPress Core releases 6.8 and 6.9, however these releases are end-of-life, and are no longer officially supported nor actively maintained. Organisations must migrate to a supported release.


https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
Action

Recommended: Block anonymous access to the WordPress REST API

Organisations are recommended to block anonymous access to the WordPress REST API by either:

  • Installing a plugin that blocks anonymous access to the REST API entirely.
  • Blocking /wp-json/batch/v1 and ?rest_route=/batch/v1 in your web application firewall (WAF).

Note: Both of these solutions may have an impact on legitimate use of your WordPress site.


https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core

Last edited: 20 July 2026 11:35 am