Wordpress hacked (again) but with additional remote code execution fun (versions 6.8.5 - 7.0.1)

If you host Wordpress, an advisory about recent versions (6.8.5 - 7.0.1)

11 minute YouTube walkthrough of the vulnerability

Independent proof-of-concept for the unauthenticated WordPress REST batch route-confusion SQL injection associated with Searchlight Cyber's wp2shell advisory

wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain

Remediation​

Update to WordPress 7.0.2, or 6.9.5 if the site is on the 6.9 branch.
Until then, block both /wp-json/batch/v1 and the rest_route=/batch/v1 query parameter at the edge, or require authentication for the batch endpoint via the rest_pre_dispatch filter.

uptoeleven said:

Update to WordPress 7.0.2, or 6.9.5 if the site is on the 6.9 branch.

Click to expand...

What the hell? I am paying hundreds of Dollars for paid plugins and themes every year just to prevent hacking and these wordpress morons can't get their act together. Wow!

2026 and we still have sql injections in major apps
I was 'experimenting' with this sort of stuff 20 years ago...

Expect thousands of new domains cropping up on the hacklink provider sites.

WP is begging to become a thing of the past, a new Blogger
Nowadays with AIs generating websites without depending on themes, they need to avoid this kind of silly mistake, otherwise it will be fully replaced and becomes obsolete

It's worth watching the video (if you haven't already) to show how the vulnerability arises.
It's fairly obviously discovered by AI. AI has that ability to cross-reference different vulnerabilities with each other to find an approach that can work.

Venusaur said:

WP is begging to become a thing of the past, a new Blogger
Nowadays with AIs generating websites without depending on themes, they need to avoid this kind of silly mistake, otherwise it will be fully replaced and becomes obsolete

Click to expand...

Respectfully - having seen the code AI generates I wouldn't be touting AI's ability to generate anything. From the amount of vulnerable libraries included in AI-generated websites to entirely hallucinated imports - if AI is the answer then I've no idea what the question would be...

IM Dude said:

What the hell? I am paying hundreds of Dollars for paid plugins and themes every year just to prevent hacking and these wordpress morons can't get their act together. Wow!

Click to expand...

Having worked as a PHP contractor for a bit I came across my fair share of Wordpress-driven businesses. But almost always the issues were with plugins and themes rather than with Wordpress core itself. Wordpress core had a reputation of being reasonably solid, if suffering from some poor architecture decisions (which limited some widgets on some larger sites due to some horrific inefficiencies with larger sites).

I'm wondering whether the whole Wordpress vs WP Engine thing meant that Wordpress took their eye off security stuff like this?

Wordpress 6.8.5 was released in March 2026 and code was in beta since September 2025.
Wordpress 7 went live back in May 2026 having been in beta since February 2026.

So this combination vulnerability has been in the wild at least 10 months I reckon.

That's pretty alarming.

@Steptoe is probably right about the hacklink sellers, they are going to have a field day with this. An unauth RCE in core is basically a goldmine for link injection networks. Honestly don't think WP is going anywhere though, despite what @Venusaur says... AI site builders still produce absolute garbage for actual SEO structure. Best to just block that batch endpoint at the Cloudflare level immediately because the automated scanners are already out in full force.

Voxlane said:

@Steptoe is probably right about the hacklink sellers, they are going to have a field day with this. An unauth RCE in core is basically a goldmine for link injection networks. Honestly don't think WP is going anywhere though, despite what @Venusaur says... AI site builders still produce absolute garbage for actual SEO structure. Best to just block that batch endpoint at the Cloudflare level immediately because the automated scanners are already out in full force.

Click to expand...

The automated scanners are always out in force.

It's always fun to show a client when they're umming and ahhing about cybersecurity - just how many people are trying to automatically log in to your WP site.

"But who are they?"
"They aren't anybody. They're a bunch of automated bots just sitting there trawling through IPs and addresses hoping to find a way to log in."
"But why do they know about me?"
"They don't. They trawl every url and every IP trying to do that. All the time. Day after day after day on automatic - because if they can find a server it's showtime."