CVE-2026-63030 is a REST API batch-route confusion vulnerability in WordPress Core, publicly referred to as “wp2shell,” that allows an unauthenticated attacker to reach code paths that should require authentication.

On its own, the weakness is bounded. Its severity comes from its ability to unlock a second, more serious flaw - CVE-2026-60137.

CVE-2026-63030 is a REST API batch-route confusion vulnerability in WordPress Core, publicly referred to as “wp2shell,” that allows an unauthenticated attacker to reach code paths that should require authentication. On its own, the weakness is bounded. Its severity comes from its ability to unlock a second, more serious flaw - CVE-2026-60137.

• WordPress Core 6.9.0 through 6.9.4 - Affected (full RCE chain)
• WordPress Core 7.0.0 through 7.0.1 - Affected (full RCE chain)
• WordPress Core 6.8.0 through 6.8.5 - Affected (companion SQL injection CVE-2026-60137 only)
• WordPress Core 6.9.5 and 7.0.2 - Patched

Both vulnerabilities are remotely exploitable with low attack complexity. Once chained, they allow full compromise of the site and its underlying database.

• Step 1 - Route Confusion / Auth Bypass
  The attacker sends a specially crafted request to the WordPress REST API batch endpoint (/wp-json/batch/v1), exploiting the route confusion to bypass authentication that would normally gate certain internal routes.
• Step 2 - SQL Injection
  The now-reachable code path is used to trigger the SQL injection in WP_Query's author_not_in parameter, allowing the attacker to manipulate database queries.
• Step 3 - Remote Code Execution
  The SQL injection is leveraged to achieve remote code execution on the underlying server, giving the attacker full control of the site and its data.
• Step 4 - Persistence
  Observed campaigns have deployed persistent webshells and installed malicious plugins to maintain access after initial compromise - no user interaction, credentials, or plugins are required at any stage.

CERTVU recommends the following:
Update WordPress 7.0.0 or 7.0.1 to 7.0.2 or later.
Update WordPress 6.9.0 through 6.9.4 to 6.9.5 or later.
Update WordPress 6.8.0 through 6.8.5 to 6.8.6 or later to close the companion SQL injection

Verify the update has actually applied - WordPress has enabled forced automatic updates for affected installations, but administrators should confirm rather than assume.

Inventory all WordPress instances across gov.vu infrastructure and partner sites as a priority, given the scale of WordPress's installed base.

No official workaround is recommended at this time - patching is the only effective remediation.