Two WordPress core vulnerabilities, CVE-2026-60137 and CVE-2026-63030, can be chained into wp2shell to enable unauthenticated access, SQL injection, and potentially remote code execution on affected sites. CERT-AGID urges administrators, especially public-sector operators, to update to the fixed versions and inspect systems for signs of compromise such as suspicious batch API requests, new admin accounts, web shells, or unexpected database activity. #WordPress #CERT-AGID #CVE-2026-60137 #CVE-2026-63030 #wp2shell
Keypoints
- Two vulnerabilities in WordPress core can be combined to compromise affected sites without requiring a vulnerable plugin.
- CVE-2026-60137 is a SQL injection flaw in the WordPress core.
- CVE-2026-63030 affects the handling of batch requests in the WordPress REST API.
- The chain, referred to as wp2shell, may allow unauthenticated access to restricted functionality and lead to remote code execution.
- Potential impact includes unauthorized data access, administrative account compromise, and installation of web shells or other malicious code.
- Affected versions include WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 for the full chain, while 6.8.0 to 6.8.5 are affected by the SQL injection only.
- Fixed versions are WordPress 6.8.6, 6.9.5, and 7.0.2, and CERT-AGID recommends checking for compromise indicators before or after updating.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – The attacker can chain the WordPress flaws to compromise the site through exposed web functionality (‘sfruttare la SQL injection presente nel core’; ‘accesso non autorizzato ai dati’).
- [T1505.003] Server Software Component: Web Shell – The attack may lead to installing a web shell on the system (‘installazione di web shell’).
- [T1059.004] Command and Scripting Interpreter: Unix Shell – The article mentions the possible installation of malicious PHP code that could enable further code execution (‘di altro codice malevolo sul sistema’; ‘file PHP non riconducibili all’installazione’).
- [T1195] Supply Chain Compromise – The issue is associated with WordPress core rather than a specific plugin, affecting widely deployed platform components (‘interessa direttamente WordPress e non richiede la presenza di uno specifico plugin vulnerabile’).
- [T1078] Valid Accounts – The compromise may include creation or abuse of administrative accounts (‘compromissione degli account amministrativi’; ‘creazione di nuovi account amministrativi’).
Indicators of Compromise
- [URL paths ] suspicious REST API activity – /wp-json/batch/v1, ?rest_route=/batch/v1
- [Account activity ] possible compromise indicators – new administrator accounts, unexpected administrative access
- [File artifacts ] malicious or unauthorized site changes – web shells, unknown PHP files, unexpected file modifications
- [Website content / extensions ] unauthorized additions – unknown plugins, unknown themes
- [Database activity ] signs of intrusion – unusual database access or operations
- [Configuration / secrets ] post-compromise impact – altered site settings, stolen credentials, tokens, and other secrets