Two critical vulnerabilities in WordPress Core, known as WP2Shell, are being exploited to bypass login requirements, allowing attackers to execute code remotely. The exploitation chain, identified by Seqrite, combines these flaws to enable the creation of unauthorized administrator accounts and the installation of web shells.
WP2Shell Vulnerability Details
The WP2Shell exploit relies on two known vulnerabilities: CVE-2026-63030 and CVE-2026-60137. The first affects the REST API’s batch controller, which can mishandle nested requests, leading to unauthorized access to functions requiring authentication. The second is an SQL injection flaw within the posts endpoint, allowing malicious inputs to affect database queries.
Impact and Exploitation
By chaining these vulnerabilities, attackers can bypass authentication and execute code on affected WordPress sites. This chain allows an attacker to create administrator accounts, deploy malicious plugins, and potentially take control of the server. Seqrite’s report details how these flaws are exploited, emphasizing the ease with which a site can be compromised.
Mitigation and Recommendations
WordPress versions 6.9.0 to 7.0.1 are vulnerable, while versions 6.8.6, 6.9.5, and 7.0.2 have been patched. Users are advised to update their WordPress installations to the latest version and monitor for signs of unauthorized access, such as unfamiliar admin accounts or unexplained changes in plugins.
Ensuring the security of WordPress sites involves more than just applying patches. Administrators should restrict unauthenticated access to sensitive API features where feasible, regularly review logs for suspicious activity, and inspect plugins for any unexpected changes.
In conclusion, the WP2Shell vulnerability highlights the importance of maintaining updated security measures. Site owners must remain vigilant, updating their platforms promptly and monitoring for any signs of compromise to protect against potential threats.
