WP2Shell: WordPress core REST batch route confusion to pre-auth RCE chain

NCSC-CH: Swiss websites compromised through WP2Shell are serving fake-CAPTCHA paste-and-run lures, with the follow-on payload resolved from a blockchain

UPDATE · originally covered CVE-2026-63030 / CVE-2026-60137 (WP2Shell) — WordPress Core pre-auth RCE chain moves to confirmed in-the-wild exploitation and CISA KEV (2026-07-26)

Switzerland's national cyber authority has attached its own jurisdiction's numbers to the WordPress chain this pipeline recorded reaching CISA KEV in July. In an advisory published 2026-08-07, BACS reports a rising count of compromised websites presenting fake CAPTCHAs that push visitors into executing a command themselves, puts the worldwide population of compromised sites at more than 100,000, and states it is currently seeing an increase in the number of Swiss websites being compromised and used to distribute malware (NCSC-CH, 2026-08-07).

The entry point is the already-covered one, now with reporting behind it: BACS writes that in recent days it has received an accumulation of reports from Swiss website operators and web-hosting providers describing exploitation of two recently disclosed WordPress vulnerabilities, and that "criminals use a combination of two vulnerabilities in WordPress" known as WP2Shell — CVE-2026-63030 and CVE-2026-60137 (NCSC-CH, 2026-08-07). Most of the compromised sites run WordPress.

What is new below the entry point is the delivery chain. Once a visitor follows the instruction and runs the command, it fetches further malicious code whose storage and distribution sit on a public blockchain — the technique BACS names EtherHiding — retrieved through the web interfaces of RPC providers that broker access to those networks; the payload is typically an infostealer, with Vidar named as an example, going after credentials, payment-card data and cryptocurrency wallets (NCSC-CH, 2026-08-07). That hop is why the authority's recommendation is an egress-policy one rather than a filtering one: a blockchain read has no domain to sinkhole.

Triage: the client-side execution has a distinctive shape in process-creation telemetry with parent lineage — a command interpreter (powershell.exe on Windows, the terminal shell on macOS) started from a browser process tree, immediately followed by outbound HTTP to an RPC-provider endpoint. Neither half is individually rare on a developer or administrator workstation; the sequence, on a general-office endpoint, is the signal, and the browser parentage is what separates it from legitimate admin scripting, which is not launched from a browser. On the server side, the compromise signature is the WP2Shell request pattern against the unauthenticated REST batch endpoint in web-server access logs, followed by administrator-account or plugin and theme file changes that no admin action accounts for.

CVE-2026-63030 / CVE-2026-60137 (WP2Shell) — WordPress Core pre-auth RCE chain moves to confirmed in-the-wild exploitation and CISA KEV

UPDATE · originally covered WP2Shell: pre-auth RCE chain in stock WordPress core (CVE-2026-63030 + CVE-2026-60137) — out-of-band 7.0.2 patch, exploitation expected short-term (2026-07-18)

the exploitation status of the WP2Shell chain has flipped. First coverage recorded a public checker, public proof-of-concept code and an NCSC-NL assessment that exploitation was expected shortly, but no confirmed in-the-wild activity. That is no longer the case: "both CVEs were added to CISA's Known Exploited Vulnerabilities (KEV) catalog on July 21" (Rapid7, 2026-07-22). Rapid7 updated its analysis the same day to state that "Given confirmed exploitation in the wild, Rapid7 strongly recommends investigating for signs of compromise" (Rapid7, 2026-07-22). Exploitation was observable earlier than the KEV date: Hexastrike "started seeing exploitation attempts in its honeypots over the weekend, and on Sunday the company said it had already assisted with incident response in several attacks", and watchTowr independently reported in-the-wild attempts (SecurityWeek, 2026-07-20).

Nothing about the vulnerable component, the prerequisites or the patched versions has changed — the affected branches remain 6.9.0–6.9.4 and 7.0.0–7.0.1, fixed in 6.9.5 and 7.0.2 respectively (Rapid7, 2026-07-22). What changes is the defender's posture. A chain that reaches pre-authentication code execution on a stock installation, against a platform this widely deployed across public-sector web estates, and that was being exploited within roughly 48 hours of the out-of-band release, leaves a real window in which an internet-reachable instance could have been taken over before its administrator patched. Patching closes the entry route; it does not remove a webshell, an attacker-created administrator account, or a scheduled task planted beforehand.

Triage: requests to the REST batch endpoint are a legitimate WordPress feature, so their presence alone is not the signal; what distinguishes exploitation from normal use is unauthenticated batch requests arriving from unfamiliar source ranges in tight bursts, immediately followed by a PHP file appearing under the webroot, a new administrator-role user, or an outbound connection from the web-server process. In web-server access telemetry, correlate on the sequence rather than the endpoint. Post-compromise, the higher-signal artefacts are administrator accounts created after 2026-07-17, unexpected entries in the scheduled-event table, and PHP files whose modification time postdates the release but which are not part of the shipped core distribution.

WP2Shell: pre-auth RCE chain in stock WordPress core (CVE-2026-63030 + CVE-2026-60137) — out-of-band 7.0.2 patch, exploitation expected short-term

WordPress shipped an out-of-band core security release on 2026-07-17 fixing a pre-authentication remote-code-execution chain that researcher Adam Kues of Searchlight Cyber calls WP2Shell (WordPress.org, 2026-07-17; Searchlight Cyber, 2026-07-17). The chain's first half, CVE-2026-63030, is a route-confusion weakness (CWE-436) in the REST API batch endpoint — /wp-json/batch/v1, also reachable as ?rest_route=/batch/v1 — which processes several sub-requests in one call; a parsing quirk desynchronizes internal request arrays so one sub-request executes under another's handler. Chained with CVE-2026-60137 — an SQL injection in the author__not_in parameter of WP_Query, the class that builds most WordPress database queries — it yields code execution with no authentication, no plugins and no special configuration: "the attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins" (Searchlight Cyber, 2026-07-17). The full chain affects 6.9.0–6.9.4 and 7.0.0–7.0.1; the SQL-injection component reaches back into 6.8.x, where it is exposed when a plugin or theme passes untrusted input to the parameter (ENISA EUVD, 2026-07-17). Scoring is contested between assigners: the WPScan CNA rates the RCE component 9.8 and the SQLi 5.9, while the CISA-ADP secondary assessment carried by NVD and EUVD inverts the pair at 7.5 and 9.1 (ENISA EUVD, 2026-07-18).

Searchlight Cyber withheld exploit mechanics "to give defenders time to patch" and instead published a checker tool; VulnCheck's independent analysis describes the practical post-exploitation route as dumping credential hashes via the SQL injection, cracking or reusing an administrator login, and dropping a webshell through the admin interface (VulnCheck, 2026-07-17). Public proof-of-concept code is already on GitHub — The Hacker News reports "a working proof-of-concept has gone up on GitHub" (The Hacker News, 2026-07-17), while an earlier-observed public repository carried only detection-grade probing (time-based blind SQL-injection and route-confusion checks); either way, exploit tooling is public. Exploitation status as of publication: Rapid7 was "not aware of publicly confirmed in-the-wild exploitation" as of 2026-07-17 evening (Rapid7, 2026-07-17), the CVE pair is not in CISA KEV, and a circulated secondhand exploitation claim traces back to a Patchstack database page that in fact makes only the predictive statement "this vulnerability is highly dangerous and expected to become exploited." NCSC-NL's advisory rates likelihood high and expects short-term exploitation, recommending WAF-blocking of the batch endpoint where patching must wait (NCSC-NL, 2026-07-18).