WordPress Core Pre-Authentication RCE Chain "wp2shell" Now Has Public Exploits (CVE-2026-63030 / CVE-2026-60137)

Scope: WordPress Core Versions 6.8.0 through 6.8.5 (SQL injection only), 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1 (Full RCE chain)

Severity: Red

Searchlight Cyber researcher Adam Kues disclosed "wp2shell," a two-flaw unauthenticated remote code execution chain in WordPress core requiring zero plugins, zero configuration changes, and zero user interaction, with a working public proof-of-concept exploit now available on GitHub. The chain combines CVE-2026-60137, a SQL injection in the author__not_in parameter of WordPress's internal WP_Query class, with CVE-2026-63030, a REST API batch-route confusion flaw in the /wp-json/batch/v1 endpoint introduced in WordPress 6.9 that escalates the injection to full server-level code execution, enabling an anonymous attacker to drop arbitrary PHP files onto the server and achieve complete site compromise. WordPress shipped emergency updates 6.9.5, 7.0.2, and 6.8.6 on July 18, 2026, and has enabled forced auto-updates through its built-in auto-update system, but sites with auto-updates disabled or running under managed hosting that delays updates remain exposed. Given that WordPress powers over 500 million websites globally and is the dominant CMS across Ugandan government, education, and media environments, this must be treated as a critical priority. Organizations must immediately update to WordPress 6.9.5, 7.0.2, or 6.8.6 as applicable, verify auto-updates are enabled, and scan web-accessible directories for unexpected PHP files as indicators of prior compromise.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.