A critical vulnerability chain in WordPress, called wp2shell, that allegedly allows unauthenticated attackers to exploit a pre-authentication SQL injection flaw to achieve remote code execution (RCE) on typical WordPress installations running MySQL.
Security researcher Adam Kues discovered this vulnerability chain using GPT-5.6 Sol Ultra during a multi-agent audit of the WordPress source code.
GPT-5.6 Sol Ultra Discovers WordPress Flaws
The issue affects the REST API Batch endpoint, located at /wp-json/batch/v1. This Batch API, introduced in WordPress 5.6, enables users to submit multiple virtual REST requests in a single HTTP request. The vulnerability arises from a mismatch between request validation data and the matched route handlers in the class-wp-rest-server.php file.
When WordPress processes batch requests, it maintains separate arrays for route matches and validation results. However, if a malformed request is encountered, the code adds an error to the validation array. However, it skips the corresponding route entry due to a “continue” statement.
if ( is_wp_error( $single_request ) ) {
   $has_error = true;
   $validation[] = $single_request;
   continue;
}
$match = $this->match_request_to_handler( $single_request );
$matches[] = $match;This creates an index desynchronization condition. A later request can be validated according to one REST endpoint’s parameter rules but executed by another endpoint’s handler.
According to the disclosure, attackers can exploit this behavior to bypass parameter sanitization controls across batch-enabled API routes.
The SQL injection sink reportedly resides in the public posts-listing endpoint, GET /wp/v2/posts. This API route supports author exclusion filtering via the author_exclude parameter, which is used as the internal author__not_in query variable.
WordPress safely normalizes individual values when the input is an array, but a scalar value may be interpolated into a raw SQL NOT IN clause.
if ( is_array( $query_vars['author__not_in'] ) ) {
   $query_vars['author__not_in'] = array_map(
     'absint',
     $query_vars['author__not_in']
   );
}
$author__not_in = implode(
   ',',
   (array) $query_vars['author__not_in']
);
$where .= " AND {$wpdb->posts}.post_author NOT IN ($author__not_in)";Under normal circumstances, REST parameter validation prevents an attacker from reaching this code path with an arbitrary scalar. The reported Batch API desynchronization bypasses that protection.
Because the Batch API normally rejects GET subrequests, the disclosed chain recursively invokes the batch endpoint: one layer bypasses method validation and a second layer bypasses validation of author_exclude.
The resulting SQL injection is described as read-only, but the post-exploitation path makes it far more serious. The chain uses a UNION-based query to forge WP_Post objects in WordPress’s per-request object cache.
These objects can then interact with WordPress oEmbed caching, causing controlled oembed_cache database rows to be reconciled with attacker-controlled in-memory metadata.
The researcher said this primitive can be escalated by converting a forged cache entry into a customize_changeset post. WordPress applies changesets using the user_id contained in the changeset data. A malicious changeset linked to user ID 1 can therefore temporarily grant WordPress administrator privileges.
The final stage abuses WordPress’s dynamic action hooks. By forging post status and post type values, the exploit invokes the parse_request hook while the temporary administrator context is active.
That causes the original Batch API request to be replayed with elevated privileges, allowing an attacker-controlled request to create a new administrator account.
An attacker can then sign in with that account and upload a malicious plugin ZIP through the WordPress administration interface, resulting in code execution.
Administrators should immediately review WordPress security updates, restrict public access to REST endpoints where feasible, inspect logs for suspicious requests to /wp-json/batch/v1, and investigate unexpected administrator accounts or plugin installations.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
