# wp2shell Aftermath (Wordfence) **Source**: [[3. Resources/Readwise/Articles/Wp2shell Aftermath The First Critical Unauthenticated WordPress Core RCE in Nearly a Decade]] > [!question] Lingering Questions > - What CVSS score was assigned to each CVE, and did community scoring match WordPress's own "one critical, one high" messaging once published? > - Why does Wordfence maintain a flat 30-day free-tier protection delay regardless of a vulnerability's severity tier — has that policy been reconsidered for critical-unauthenticated-RCE-class events specifically? > - How many sites remain unpatched, and what was the actual dwell time for any site compromised between the July 17 patch and a delayed manual update? Not stated in the source. > [!tip] Article Ideas > - REST API batch-endpoint route confusion as a pattern class worth a standalone audit checklist for other Core/plugin batch or bulk API implementations, not just this one instance. > [!link] Cross Reference > - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — direct fit: Core-level unauthenticated RCE, patch-verification guidance, firewall-tier gap > - [[3. Resources/Permanent Notes/Update Signatures Prove Provenance Not Freshness]] — the "confirm the update actually completed" guidance in this article is the freshness half of that same provenance/freshness distinction > - [[3. Resources/Permanent Notes/Casual Self-Hosting Trades a Subscription Fee for an Unvetted Security Liability]] — adjacent theme: unmanaged/unpatched software as converted, not avoided, risk > [!quote] Vocabulary > - **Route confusion** — a REST API validation/execution desync where the sanitization path and the execution path for the same request diverge, letting attacker-controlled input reach a route that should have sanitized it > - **Forced automatic update** — a WordPress Core mechanism reserved for exactly this severity class (unauthenticated, no-interaction-required); the article treats its use here as itself a severity signal ## Bib capsule WordPress Core shipped emergency patches (6.8.6, 6.9.5, 7.0.2) on July 17, 2026, for a two-bug chain — dubbed wp2shell — combining an unauthenticated SQL injection (CVE-2026-60137, via the `author__not_in` parameter) with a REST API batch-request route-confusion bug (CVE-2026-63030), letting an unauthenticated attacker create an administrator account and execute code. ## Author's thesis Patch immediately across all three affected branches — firewall rules reduce but don't eliminate exposure while a site sits unpatched, and exploitation began within hours of disclosure, not days. ## Key arguments (≤3) 1. **The chain requires no login and no user interaction** — reachable on any exposed, unpatched public WordPress install running 6.8.x through 7.0.x, which is why Core force-updated rather than waiting for manual patching. 2. **Exposure isn't uniform across versions** — 6.9.x/7.0.x carry both bugs and are exposed to full RCE; 6.8.x carries only the SQL injection half and can't reach full RCE through this specific chain. 3. **The patch-to-exploit window compressed to hours, not days** — probing against the affected endpoint began the evening of disclosure, and a public checker tool (wp2shell.com) plus a detailed technical writeup were both live within 24–48 hours. ## Claim atoms ### wp2shell chains SQL injection with REST API route confusion > [!quote] ID:manual-1 > CVE-2026-60137, an unauthenticated SQL injection issue involving the author__not_in query parameter. Names the exact reachable parameter — useful for anyone grepping logs or WAF rules for this specific pattern. ### Exploitation began within hours of patch release > [!quote] ID:manual-2 > we observed the first exploit-shaped probing against the REST API batch endpoint Collapses the assumed "grace period" after a patch to effectively zero — directly supports the permanent claim below. ### 6.8.x escapes full RCE, keeps SQL injection exposure > [!quote] ID:manual-3 > WordPress 6.8.x is affected by the SQL injection vulnerability and is patched in 6.8.6 Distinguishes "urgent, full compromise possible" (6.9.x/7.0.x) from "urgent, but narrower exposure" (6.8.x) for triage purposes. ## Permanent candidates - **A patch release starts an exploitation race, not a grace period** — the strongest, most reusable candidate; promoted below. ## Processing checklist - [ ] Verify CVSS scores for CVE-2026-60137 and CVE-2026-63030 against the official WordPress/NVD advisory - [x] Connect into the relevant MOC — [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] ## Links - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — Core-level unauthenticated RCE and the firewall-tier free/paid protection gap