Introduction

NC4 is monitoring active exploitation of a critical vulnerability chain affecting WordPress Core, commonly referred to as wp2shell. The exploit combines CVE-2026-63030 and CVE-2026-60137 to achieve unauthenticated remote code execution (RCE) against affected WordPress installations.

WordPress released security updates on 17 July 2026. Functional exploit code was published shortly afterwards, and multiple security vendors subsequently reported widespread scanning and successful exploitation of internet-facing systems.

NC4 assesses with moderate confidence that current activity is predominantly opportunistic rather than targeted. This assessment is based on publicly reported scanning patterns, the rapid availability of exploit code and the absence of reporting indicating victim-specific targeting. For organisations operating affected WordPress deployments, patching should be treated as the immediate priority. Where systems remained exposed after public disclosure, patching should be accompanied by a compromise assessment, as remediation alone does not remove persistence established before the update.

Impact

Successful exploitation provides remote code execution within the WordPress environment. The resulting impact will depend on the privileges assigned to the web application and the security posture of the underlying host.

An attacker may subsequently:

• deploy webshells;
• establish persistent access;
• install or modify WordPress plugins and themes;
• obtain database credentials and WordPress authentication material;
• alter website content or application configuration; or
• leverage the compromised host to support additional malicious activity.

Brief Description

Threat Assessment

The wp2shell exploit chain combines:

• CVE-2026-60137 - an SQL injection vulnerability affecting the author__not_in parameter within WP_Query; and
• CVE-2026-63030 - a REST API batch-route confusion vulnerability that allows the SQL injection to be reached without authentication.

Together, the vulnerabilities provide a path to remote code execution on affected WordPress installations. Vendor reporting indicates that exploitation activity began shortly after public disclosure. Observed post-exploitation activity includes PHP webshell deployment, installation of malicious plugins, attempts to obtain database credentials and WordPress authentication keys, and persistent command execution. Although exploitation has been reported by multiple organisations, no reliable public attribution has been established. Current activity is more consistent with broad opportunistic exploitation than actor-specific campaigns.

Affected Product

WordPress Core prior to version 6.8  is not affected since the vulnerable  author__not_in logic was introduced in version 6.8.

Recommendation

Immediate Actions

NC4 recommends that organisations:

• upgrade affected systems to WordPress 6.8.6, 6.9.5, 7.0.2, or a later supported release;
• confirm that the update completed successfully;
• review privileged accounts for unauthorised changes;
• inspect WordPress directories for unfamiliar PHP files, plugins and scheduled tasks; and
• rotate administrator credentials, database credentials and WordPress authentication salts where compromise is confirmed.

Temporary Mitigation

Where patching cannot be completed immediately, restrict unauthenticated access to:

• /wp-json/batch/v1
• ?rest_route=/batch/v1

This measure should only be used to temporarily reduce exposure where immediate patching is not possible. It does not remediate the underlying vulnerabilities, nor does it remove access established through prior exploitation. Organisations should apply the appropriate security updates at the earliest opportunity. Blocking these endpoints may also disrupt legitimate WordPress functionality.

Additional Security Measures

Organisations should also:

• restrict administrative access to trusted networks or VPNs;
• enforce multi-factor authentication for privileged accounts;
• monitor administrative activity, plugin installation and REST API requests;
• ensure current offline backups are available; and
• retain sufficient logging to support incident response

Detection and Monitoring

The following activity may warrant further investigation.

Reporting

Organisations identifying attempted exploitation or confirmed compromise should report the incident through the appropriate national reporting channel.

NCII entities should continue to comply with reporting obligations under the Cyber Security Act 2024 (Act 854) and associated regulations. Other organisations are encouraged to submit incident reports through NACSA’s designated reporting channels.

Disclaimer

This advisory reflects information available to NC4 at the time of publication. Technical details, exploitation activity and attribution remain subject to change as additional reporting becomes available.

References

WordPress – WordPress 7.0.2 Release    https://wordpress.org/news/2026/07/wordpress-7-0-2-release/

WordPress Documentation – Version 7.0.2    https://wordpress.org/documentation/wordpress-version/version-7-0-2/

National Vulnerability Database – CVE-2026-63030    https://nvd.nist.gov/vuln/detail/CVE-2026-63030

National Vulnerability Database – CVE-2026-60137    https://nvd.nist.gov/vuln/detail/CVE-2026-60137

GitHub Security Advisory – GHSA-ff9f-jf42-662q / CVE-2026-63030    https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q

GitHub Security Advisory – GHSA-fpp7-x2x2-2mjf / CVE-2026-60137    https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf

Searchlight Cyber / Assetnote – wp2shell Research    https://wp2shell.com/

Wiz Research – Exploitation in the Wild of wp2shell    https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137