how wp2shell actually works: the two-loop bug that lets an anonymous request run code on WordPress

The exploit hinges on a subtle mistake — WordPress's REST API validates and executes batch requests in two separate loops. When one step fails,… Aliteq Priya Nair · Software & Systems Editor

WordPress's REST API batch endpoint lets you send many API requests in one HTTP call — it validates them all, then executes them all.

The chain in five steps

Validation and execution run in separate loops. The bug is that a failure in the first loop desynchronises the two.

The chain in five steps

When wp_parse_url() fails on one request, every subsequent request in the batch gets dispatched under the wrong handler — route confusion (CVE-2026-63030).

The chain in five steps

That misrouting lets an anonymous request reach WP_Query's author__not_in parameter, which is vulnerable to SQL injection (CVE-2026-60137).

The chain in five steps

SQL injection in WordPress can be escalated to remote code execution, so the chain ends in full server compromise — no login required.

The chain in five steps

If you run Redis or Memcached, you may not be exploitable via this specific path — but that is a lucky side effect, not a security control. The advisory is describing this exploit's technique, and a…

Don't treat the object cache as a fix

Read the full story

Aliteq how wp2shell actually works: the two-loop bug that lets an anonymous request run code on WordPress Read the full story on Aliteq