WordPress core WP_Query author__not_in SQL injection (WP2Shell chain component)

Searchlight Cyber's Adam Kues tasked OpenAI's GPT5.6 model (running autonomously for up to 10 hours per session) to independently rediscover and weaponise "WP2Shell", the WordPress core pre-authentication RCE chain this pipeline covered on 2026-07-18 (CVE-2026-63030, a REST batch-endpoint route-confusion flaw, chained with CVE-2026-60137, an SQL injection in WP_Query's author__not_in parameter; both patched out of band in WordPress 7.0.2/6.9.5/6.8.6 on 2026-07-17). Without human guidance beyond the initial task, the model recursively chained batch API requests to bypass method validation, poisoned the request cache with fabricated posts, abused the oEmbed subsystem to insert database rows, and replayed a request with elevated administrator context via the parse_request hook, ending with an unauthorised admin account on a stock, plugin-free install (Searchlight Cyber, 2026-07-20). Kues put the cost at roughly $25, "50% of weekly usage ... ~ $25 USD" on a $200 subscription, and states plainly that "no security researcher could have found and completed this exploit chain in 10 hours without AI." Infosecurity Magazine corroborates (Infosecurity Magazine, 2026-07-20).

Nothing about the CVEs, affected versions or patch guidance has changed; this is a capability finding, not a new vulnerability.

The exploitation status of the WP2Shell chain has flipped. First coverage recorded a public checker, public proof-of-concept code and an NCSC-NL assessment that exploitation was expected shortly, but no confirmed in-the-wild activity. That is no longer the case: "both CVEs were added to CISA's Known Exploited Vulnerabilities (KEV) catalog on July 21" (Rapid7, 2026-07-22). Rapid7 updated its analysis the same day to state that "Given confirmed exploitation in the wild, Rapid7 strongly recommends investigating for signs of compromise" (Rapid7, 2026-07-22). Exploitation was observable earlier than the KEV date: Hexastrike "started seeing exploitation attempts in its honeypots over the weekend, and on Sunday the company said it had already assisted with incident response in several attacks", and watchTowr independently reported in-the-wild attempts (SecurityWeek, 2026-07-20).

Nothing about the vulnerable component, the prerequisites or the patched versions has changed; the affected branches remain 6.9.0–6.9.4 and 7.0.0–7.0.1, fixed in 6.9.5 and 7.0.2 respectively (Rapid7, 2026-07-22). What changes is the defender's posture. A chain that reaches pre-authentication code execution on a stock installation, against a platform this widely deployed across public-sector web estates, and that was being exploited within roughly 48 hours of the out-of-band release, leaves a real window in which an internet-reachable instance could have been taken over before its administrator patched. Patching closes the entry route; it does not remove a webshell, an attacker-created administrator account, or a scheduled task planted beforehand.

Triage: requests to the REST batch endpoint are a legitimate WordPress feature, so their presence alone is not the signal; what distinguishes exploitation from normal use is unauthenticated batch requests arriving from unfamiliar source ranges in tight bursts, immediately followed by a PHP file appearing under the webroot, a new administrator-role user, or an outbound connection from the web-server process. In web-server access telemetry, correlate on the sequence rather than the endpoint. Post-compromise, the higher-signal artefacts are administrator accounts created after 2026-07-17, unexpected entries in the scheduled-event table, and PHP files whose modification time postdates the release but which are not part of the shipped core distribution.

Switzerland's national cyber authority has attached its own jurisdiction's numbers to the WordPress chain this pipeline recorded reaching CISA KEV in July. In an advisory published 2026-08-07, BACS reports a rising count of compromised websites presenting fake CAPTCHAs that push visitors into executing a command themselves, puts the worldwide population of compromised sites at more than 100,000, and states it is currently seeing an increase in the number of Swiss websites being compromised and used to distribute malware (NCSC-CH, 2026-08-07).

The entry point is the already-covered one, now with reporting behind it: BACS writes that in recent days it has received an accumulation of reports from Swiss website operators and web-hosting providers describing exploitation of two recently disclosed WordPress vulnerabilities, and that "criminals use a combination of two vulnerabilities in WordPress" known as WP2Shell, CVE-2026-63030 and CVE-2026-60137 (NCSC-CH, 2026-08-07). Most of the compromised sites run WordPress.

What is new below the entry point is the delivery chain. Once a visitor follows the instruction and runs the command, it fetches further malicious code whose storage and distribution sit on a public blockchain (the technique BACS names EtherHiding) retrieved through the web interfaces of RPC providers that broker access to those networks; the payload is typically an infostealer, with Vidar named as an example, going after credentials, payment-card data and cryptocurrency wallets (NCSC-CH, 2026-08-07). That hop is why the authority's recommendation is an egress-policy one rather than a filtering one: a blockchain read has no domain to sinkhole.

Triage: the client-side execution has a distinctive shape in process-creation telemetry with parent lineage, a command interpreter (powershell.exe on Windows, the terminal shell on macOS) started from a browser process tree, immediately followed by outbound HTTP to an RPC-provider endpoint. Neither half is individually rare on a developer or administrator workstation; the sequence, on a general-office endpoint, is the signal, and the browser parentage is what separates it from legitimate admin scripting, which is not launched from a browser. On the server side, the compromise signature is the WP2Shell request pattern against the unauthenticated REST batch endpoint in web-server access logs, followed by administrator-account or plugin and theme file changes that no admin action accounts for.

The WP2Shell WordPress chain that NCSC-CH named as the entry point for compromised Swiss websites serving fake-CAPTCHA lures now has a published, fully documented route from where it stops to native root. Calif's wp2root write-up of 2026-08-05 is the delta (Calif, 2026-08-05); the original entry stands unchanged.

The premise is the hardened-host case defenders actually rely on. As the researcher puts it, "wp2shell drops you inside the PHP interpreter, and on a hardened host that interpreter is locked down. Dangerous functions like system() and exec() are switched off with disable_functions, the filesystem can be mounted read-only, and there may be nowhere to write a file." wp2root's contribution is that none of those three controls holds.

Escaping PHP uses a use-after-free on the legacy Serializable interface path, where recursive unserialize() calls inside a Serializable::unserialize() body share the outer parser's reference table and a later property-table resize frees a bucket the outer parser still holds. The resulting arbitrary read builds a chain that locates the PHP binary and its gadgets in the live process rather than relying on hardcoded offsets, and then (this is the part that matters for anyone treating disable_functions as a boundary) "recovers the native system handler and calls it directly, in native code, even though disable_functions took away the PHP-level name." The setting removes a name, not the underlying handler. The alternative path launches a position-independent stager that creates an anonymous in-memory file, pins it on a file descriptor that survives execve, and executes it without anything reaching disk.

The root step is where this stops being a research curiosity. It is CVE-2026-31431, "Copy Fail", a logic flaw reachable through the kernel's AF_ALG crypto socket interface and splice() that lets an unprivileged local user overwrite the page-cache copy of a setuid-root binary with a small write. Running that binary then executes the attacker's cached stub as root. Its discloser is explicit about the defensive consequence: "The su file on disk is never modified, so file-integrity monitoring that watches file contents or writes to the binary sees nothing." The same page records that "The same 732-byte Python script roots every Linux distribution shipped since 2017" (Xint Code, 2026-04-29).

The fact that changes the risk calculation, and that neither the original coverage nor the queue note carried: CVE-2026-31431 has been on CISA's Known Exploited Vulnerabilities catalogue since 2026-05-01, listed as a Linux Kernel incorrect-resource-transfer flaw allowing privilege escalation, entirely independent of this chain-building exercise (CISA, catalog version 2026.08.07); the kernel's own CVE announcement records the flaw (Linux kernel CVE team, 2026-04-22). The kernel half of wp2root is not a proof of concept; it is a bug attackers are already using, now documented as the root step for a WordPress compromise path with confirmed exploitation against this constituency's own web estate.

Detection, telemetry class first. On the PHP side the discriminating signal is a web-server worker process spawning a child whose executable resolves to an anonymous memory-backed file rather than a normal on-disk binary; legitimate PHP application workflows do not create processes that way, which makes it low-noise. For the kernel step, any process holding an AF_ALG socket is itself unusual: the mainstream consumers of kernel crypto, including disk encryption, kernel TLS and IPsec, use the in-kernel API and never touch AF_ALG. Triage: a setuid-root binary executing is ordinary on every Linux host, so that event alone is noise; the composite that is not ordinary is an AF_ALG socket opened and closed by a web-application process, followed shortly by a setuid binary running under that same process tree.