From Zero to Shell: The wp2shell Chain Strikes WordPress Core in…

The HackerHood group has reproduced the wp2shell exploit chain against WordPress 6.9.1 in a lab setting, achieving pre-authentication remote code execution. CISA has already added both CVEs to its Known Exploited Vulnerabilities catalog with two distinct mandatory patching deadlines.

On July 23, 2026, the HackerHood group published the full technical demonstration of the wp2shell vulnerability against WordPress 6.9.1, achieving pre-authentication remote code execution in a controlled laboratory environment. The same attack chain is already flagged as actively exploited by CISA, which has imposed two separate mandatory remediation deadlines for the two CVEs involved.

The analysis comes at a critical moment for WordPress patch governance: the demonstration proves the entire flow—from the initial HTTP request to an interactive shell—takes seconds and requires no manual attacker interaction.

Key Takeaways

Two chained CVEs in WordPress core: CVE-2026-60137 (SQL injection in WP_Query) and CVE-2026-63030 (route confusion in the REST /batch/v1 endpoint), both with active CISA KEV listings
The root cause lies in a mismatch between parallel match and validation arrays when wp_parse_url() fails to normalize a sub-request path
The lab chain includes automatic admin user creation, automatic authentication, deployment of a webshell disguised as a dummy plugin, and system command execution on a Windows/XAMPP stack
CISA set the due dates for July 24, 2026 for CVE-2026-63030 and August 4, 2026 for CVE-2026-60137, with SSVC classifying the former as exploitation:active, automatable:yes, technicalImpact:total

The Mechanism: How Two Distinct Vulnerabilities Chain into RCE

The technical core is a structural mismatch in the batch handling of WordPress' REST /batch/v1 endpoint. The function serve_batch_request_v1() manages two parallel arrays indexed on the same offset: one for route matches, the other for validation results. When wp_parse_url() fails to normalize a sub-request path, the element is added to the validation results array but not to the matches array.

This route confusion allows a malicious request to "inherit" the validation of previous requests in the same batch. The immediate consequence is access to protected parameters that should be filtered, specifically author__not_in in WP_Query, where the SQL injection documented as CVE-2026-60137 triggers.

The lab chain proceeds in sequence: unauthenticated request to the batch endpoint, route confusion, SQL injection, creation of an admin user with auto-generated credentials, automatic authentication under that user, upload of a plugin containing a webshell, and execution of system commands with web-process privileges. All of this occurs without manual interaction and in seconds, as documented in the published terminal screenshots.

"from an unauthenticated HTTP request you reach, in seconds and without any manual interaction, code execution with web-process privileges" — HackerHood/Red Hot Cyber

Affected Versions and Emergency Patches

According to the NVD record for CVE-2026-63030, vulnerable versions are 6.9 through 6.9.5 excluded, and 7.0 through 7.0.2 excluded. The HackerHood article confirms the PoC published on GitHub (repository Icex0/wp2shell-poc) works on the 6.9.0-6.9.4 range, with the specific lab target on version 6.9.1.

The emergency patched releases are 7.0.2, 6.9.5, and 6.8.6. The demonstration was conducted on a WordPress installation with a Windows/XAMPP stack, with adaptation of the original PoC developed for Linux environments.

The NVD record for CVE-2026-60137 reports a CVSS 3.1 score of 5.9 (MEDIUM), with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The record for CVE-2026-63030 reports the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicative of critical severity, but does not specify the full numerical score in the available dossier.

The CISA Context: Active Exploitation and Mandatory Deadlines

Both CVEs appear in CISA's Known Exploited Vulnerabilities (KEV) catalog with differentiated risk profiles. For CVE-2026-63030, the CISA-ADP contribution in the NVD record includes the SSVC analysis with exploitation:active, automatable:yes, technicalImpact:total. The CISA-imposed due date is July 24, 2026.

For CVE-2026-60137, the KEV lists a required action with a due date set for August 4, 2026. The temporal discrepancy reflects the agencies' differing assessment of the route confusion component versus the isolated SQL injection.

WPScan, cited as a contributor in the NVD records, confirms detection of the two chained CVEs in version 6.9.1, as reported in the HackerHood article.

Immediate Actions

Verify the WordPress version in use: installations on the 6.9.x series before 6.9.5 and 7.0.x before 7.0.2 are vulnerable per the NVD record
Apply the emergency updates released in versions 7.0.2, 6.9.5, or 6.8.6, respecting the CISA due date of July 24, 2026 for CVE-2026-63030
Check for unrecognized admin accounts created recently, given the demonstrated capability for automatic generation of privileged users
Review access logs for the /wp-json/batch/v1 endpoint for anomalous requests that may indicate route confusion attempts

Lab Versus Reality: The Dossier's Limits

HackerHood's demonstration is explicitly contextualized as an educational exercise in an isolated lab. Direct quotes emphasize that "all activities described were conducted in an isolated and controlled laboratory, on a dedicated WordPress installation devoid of real data, specifically set up for vulnerability analysis."

It is not confirmed that the exposed chain corresponds exactly to the in-the-wild attacks signaled by CISA KEV. The dossier does not specify the nature of data potentially exposed in real incidents, nor does it identify the operators behind the active exploitation. The editorial claim of "500 million potentially vulnerable sites" is not independently verified and should be read as a potential impact estimate, not a count of installations actually at risk.

Also missing are details on the responsible disclosure timeline: the dossier does not indicate who originally discovered the vulnerability, nor the date of disclosure to the WordPress security team.

The demonstration's value lies in the concrete proof of extreme automatability. CISA has already classified the exploit as automatable:yes; HackerHood provided visual verification that this classification corresponds to an attack replicable without significant adaptation from one machine to another. For administrators delaying updates for plugin compatibility, the safety margin has shrunk drastically.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references