wp2shell

WP2Shell WordPress RCE: ModSecurity Protection

by

Malware.Expert – ModSecurity Rules now protect WordPress websites against active WP2Shell attacks. The protection blocks malicious author_exclude SQL injection requests used in the unauthenticated WordPress Remote Code Execution exploit chain.

The virtual patch was released on July 18, 2026, in Malware Expert ModSecurity Rules version 1.2026.12.

What is WP2Shell?

WP2Shell is a critical vulnerability chain affecting WordPress Core. It combines two separate security vulnerabilities:

  • CVE-2026-63030: REST API batch request route confusion.
  • CVE-2026-60137: SQL injection through the WordPress WP_Query author__not_in parameter, exposed through the REST API as author_exclude.

When chained together, these vulnerabilities may allow an unauthenticated attacker to manipulate WordPress database queries, create an administrator account and ultimately execute arbitrary code by using normal administrator functionality, such as uploading a malicious plugin.

The attack is performed through a specially crafted HTTP POST request sent to one of the WordPress REST API batch endpoints:

/wp-json/batch/v1
/?rest_route=/batch/v1

No existing WordPress account or vulnerable third-party plugin is required for the complete WP2Shell exploit chain.

How the WP2Shell attack works

The REST API batch endpoint allows multiple WordPress REST requests to be included in a single HTTP request. The route confusion vulnerability can cause a validated sub-request to be dispatched to an unintended WordPress callback.

An attacker can use this behavior to pass a malicious author_exclude value to a vulnerable WordPress query. A real attack request may contain an encoded SQL injection payload similar to the following:

/wp/v2/widgets?author_exclude=[encoded SQL injection payload]

The SQL injection can then be combined with additional REST API requests to escalate the attack, create an unauthorized administrator account and achieve complete site compromise.

Malware Expert ModSecurity protection

Malware Expert ModSecurity Rules detect the malicious SQL injection stage inside the WP2Shell REST API batch request body.

The protection validates the author_exclude parameter and permits expected numeric values, including comma-separated author ID lists. Requests containing SQL syntax or other invalid input are denied before they reach WordPress or the database server.

For example, legitimate parameter values such as the following remain permitted:

author_exclude=1
author_exclude=1,2,15

A malicious value containing SQL operators, injected queries or SQL comments is blocked with an HTTP 403 Forbidden response.

Example of a blocked WP2Shell attack

The following ModSecurity audit log entry shows an active WP2Shell SQL injection attempt being denied:

ModSecurity: Access denied with code 403 (phase 2).
[id "500700"]
[msg "Malware.Expert - WordPress Core REST batch author_exclude RCE chain blocked"]

Because the request is denied during ModSecurity request-body inspection, the malicious batch request is not processed by WordPress and the injected query does not reach MySQL.

Targeted protection without blocking the REST API

The Malware Expert rule does not disable the complete WordPress REST API or block every request to the batch endpoint. Instead, it targets the malicious input required by the known WP2Shell SQL injection exploit chain.

Internet scanners may send non-destructive requests to determine whether a WordPress installation has the REST API route confusion vulnerability. These detection requests do not necessarily contain SQL injection and may therefore be logged without being blocked.

This is expected behavior. A vulnerability probe is not the same as an attempt to create an administrator account or execute code. The dangerous SQL injection payload is blocked when it is detected.

Affected WordPress versions

The SQL injection vulnerability affects the following WordPress Core versions:

  • WordPress 6.8 through 6.8.5
  • WordPress 6.9 through 6.9.4
  • WordPress 7.0 through 7.0.1

The complete REST API route confusion and RCE chain affects:

  • WordPress 6.9 through 6.9.4
  • WordPress 7.0 through 7.0.1

The vulnerabilities have been fixed in WordPress versions 6.8.6, 6.9.5 and 7.0.2, depending on the WordPress release branch.

Update WordPress even when WAF protection is active

A ModSecurity virtual patch provides an important additional layer of protection, especially during active mass exploitation. However, a web application firewall should not be considered a replacement for installing the official WordPress security update.

Website administrators should:

  • Update WordPress Core to a patched and supported version.
  • Verify that automatic WordPress security updates completed successfully.
  • Install the latest Malware Expert ModSecurity rules.
  • Review logs for suspicious requests to the WordPress batch endpoints.
  • Check for unknown WordPress administrator accounts.
  • Inspect plugin, cache, upload and must-use plugin directories for unauthorized PHP files.

Protection availability

WP2Shell protection is included in Malware Expert ModSecurity Rules version 1.2026.12, released on July 18, 2026.

Customers should ensure that their rules are current and that ModSecurity is running in blocking mode rather than detection-only mode.

For additional information, see: