New WordPress Security Vulnerability: wp2shell

Dangerous Combination of Vulnerabilities

At the heart of the threat are the vulnerabilities CVE-2026-60137 and CVE-2026-63030. When combined, they enable a chain of attacks known in the security community as wp2shell:

• Inadequate input sanitization: The `author__not_in` parameter within the core `WP_Query` component is not sufficiently filtered.
• API error: There is a routing error (route confusion) in the REST API.

By exploiting both vulnerabilities in combination, unauthenticated attackers can inject and execute malicious code. What makes this particularly alarming is that the attack does not require user authentication, works in a standard WordPress installation, and is completely independent of any installed plugins.

Authorities Warn of Active Exploitation

The BSI classifies the threat level as high. The agency emphasizes that functional proof-of-concept code is already circulating on the internet and that the first real-world attack attempts have been recorded.

What Administrators Need to Do Now

Although the majority of the estimated 600 million WordPress installations worldwide install updates automatically, projections indicate that around 15 percent (approximately 90 million instances) remain unprotected.

1. Check your system version: Immediately verify whether your version has been updated to the patched version mentioned above.
2. Use testing tools: Adam Kues, who discovered the vulnerability, offers a free online tool that can be used to test your own site for this vulnerability.
3. Apply workarounds: If a direct core update is not possible due to compatibility issues, you should temporarily implement the emergency measures recommended by the researcher.