Hackers Can Take Over WordPress Websites Without a Password Using Two Security Flaws

Hackers can compromise vulnerable WordPress websites without stealing passwords by chaining two security flaws in the platform’s core.

Disclosed in July 2026, the chain involves CVE-2026-63030 and CVE-2026-60137. Unlike attacks dependent on vulnerable extensions, WP2Shell affects default WordPress installations without requiring a third-party plugin.

Public exploit code and observed exploitation have made unpatched deployments an urgent remediation priority.

The initial vulnerability, CVE-2026-63030, affects the REST API batch controller exposed through /wp-json/batch/v1. This component processes multiple API requests packaged inside one JSON payload.

Crafted nested requests confuse route resolution, enabling unauthenticated attackers to reach handlers that would otherwise be inaccessible without authentication.

The weakness provides the entry point rather than directly executing code.

Attackers then exploit CVE-2026-60137, an SQL injection vulnerability involving the posts endpoint.

Its public author_exclude parameter maps to the internal author__not_in argument in WP_Query. Insufficient sanitization allows malicious input to alter database queries, turning the routing weakness into an accessible database attack primitive.

The transition from database manipulation to code execution is particularly consequential.

Akamai’s analysis describes exploitation through WordPress object caching and post-processing behavior to manipulate application state, assume an administrative context, and provision a privileged account without cracking password hashes.

Seqrite Researchers observed that, Dubbed WP2Shell, the attack combines REST API route confusion with SQL injection, allowing unauthenticated attackers to progress from publicly accessible endpoints to remote code execution.

That administrative foothold can support subsequent malicious actions, but investigators must distinguish demonstrated capabilities from confirmed outcomes.

WordPress Websites at Risk

F5 Labs captured exploitation attempts against its sensors; it explicitly stated that those observations did not include deployment of a web shell.

F5 Labs observed an exploit request originating from 185.242.3.238, delivering nested batch requests and UNION-based SQL injection.

The same 735-byte payload appeared against at least two US-based sensors, indicating automated replay rather than an isolated probe.

The source address represents observed infrastructure, not attribution to a particular threat actor.

Defenders should inspect POST requests to /wp-json/batch/v1 and alternative routes including /?rest_route=/batch/v1 and /index.php?rest_route=/batch/v1.

The exploitation process creates and subsequently removes temporary files matching the temp-write-test-* pattern under wp-content/.

Suspicious combinations include nested request arrays, the author_exclude parameter, SQL keywords, hexadecimal values, and encoded query-manipulation characters.

Network detections should target the public parameter rather than author__not_in, which does not appear directly in HTTP requests.

Host investigations should examine unexpected administrator accounts, newly installed plugins, modified PHP files, and unusual outbound connections.

These findings require contextual validation: legitimate maintenance also changes application files, while a suspicious batch request alone does not establish successful server compromise.

The complete chain affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. WordPress 6.8.0–6.8.5 is affected by the SQL injection vulnerability but not the complete chain.

Fixes shipped in 6.8.6, 6.9.5, and 7.0.2; WordPress versions preceding 6.8 are unaffected by these issues.

WordPress released the security updates on July 17 and enabled forced automatic updates for affected installations.

Administrators should verify deployment rather than assume background updates succeeded, prioritize a current supported release, and review accounts, plugins, scheduled tasks, and database changes.

Where operationally feasible, restricting unauthenticated access to affected REST functionality offers additional protection, but cannot replace patching or investigation of potentially compromised systems.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.