"wp2shell": AI-Discovered WordPress Pre-Auth RCE Chain Exploited in the Wild (CVE-2026-63030, CVE-2026-60137)

WordPress Core 6.9.0-6.9.4 and 7.0.0-7.0.1 for the full chain; 6.8.0-6.8.5 for the SQL injection component

A Searchlight Cyber researcher pointed GPT-5.6 Sol Ultra at the WordPress source and instructed it to run up to four agents for at least six hours hunting pre-authentication RCE paths. The model returned a working chain in roughly 10 hours at about $25 in API cost. The chain pairs CVE-2026-63030 (route confusion in the `/wp-json/batch/v1` REST batch endpoint, CVSS 9.8) with CVE-2026-60137 (`author__not_in` WP_Query SQL injection, CVSS 5.9): the batch API validates all bundled requests before executing them, and a malformed request desynchronizes the validation and handler arrays. WordPress patched and force-pushed automatic updates on July 17. Proof-of-concept exploits appeared within hours, and by July 20 New Zealand's National Cyber Security Centre warned of real-world exploitation; Wiz observed active exploitation of cloud-hosted instances with persistent webshells ranging from one-liners to 150KB attack platforms. Roughly 60% of WordPress installations were vulnerable at publication, falling to about 50% within 24 hours. CISA added both CVEs to the KEV catalog on July 21

A two-loop validate-then-execute design in the REST batch endpoint that falls out of sync on malformed input, chained to a SQL injection in query argument handling. The security-relevant novelty is the discovery method: an LLM-driven multi-agent search found a pre-auth RCE chain in a codebase reviewed by humans for two decades, for the price of a takeout meal, and attackers weaponized it within hours of publication