Key takeaways
Researchers have revealed details regarding a critical vulnerability chain that impacts WordPress Core. The issue, tracked as CVE-2026-63030 and CVE-2026-60137, represents a significant risk to web infrastructure given the sheer number of exposed WordPress deployments worldwide.
The chain begins with an unauthenticated SQL injection that is reachable through the WordPress REST Batch API and can be escalated to full remote code execution (RCE) on a default installation.
Although patches are available upstream, a large number of production environments remain exposed and unpatched.
Our existing Adaptive Security Engine SQL injection protections already provide meaningful coverage against the entry point of this attack. In addition, we have deployed a new Rapid Rule to capture variants specific to this chain.
Vulnerability details
An input-validation weakness exists in the WordPress REST API batch endpoint. The batch API is designed to let clients bundle several API operations into a single request. Because of a flaw in how the endpoint aligns validated requests with their execution handlers, an attacker can cause a request to be validated against one route but executed against a different one.
This desynchronization lets an attacker bypass the parameter sanitization that the rest of the WordPress REST API relies on. When combined with a post-listing parameter that fails to sanitize non-array input before it reaches the database layer, the result is an unauthenticated SQL injection. Because the batch endpoint is reachable without any credentials and requires no user interaction, it is highly accessible to malicious actors.
How the WordPress attack works
The attack abuses the batch endpoint's handler-alignment flaw to insert an unsanitized parameter into a database query.
SQL injection: By supplying a specially crafted request body to the batch endpoint, an attacker can route an attacker-controlled value into a query without escaping, allowing extraction of arbitrary database contents pre-authentication.
Privilege escalation to RCE: Rather than relying on cracking hashed credentials, the injection is chained through WordPress's object caching and post-processing behavior to manipulate stored state, assume an administrative context, and ultimately provision a privileged account. From there, an attacker can install a malicious plug-in and achieve arbitrary code execution.
Because the initial entry point is an unauthenticated SQL injection, blocking the injection attempt disrupts the entire chain before escalation is possible.
The vulnerability chain affects WordPress Core installations that expose the REST batch API in a default configuration. Administrators should apply the latest WordPress Core security release as soon as it is available and confirm that automatic background updates are enabled.
Mitigation with Akamai App & API Protector
Akamai App & API Protector customers already benefit from Adaptive Security Engine coverage against SQL injection, which detects and blocks the injection that serves as the foundation of this attack chain. This means customers with enabled SQL injection protections have baseline coverage against the core of this threat today.
To provide targeted, defense-in-depth coverage for variants specific to this chain, we have deployed a new Rapid Rule:
3000986 v1 — WordPress Unauthenticated RCE via wp2shell Attack Detected (CVE-2026-63030, CVE-2026-60137)
Summary
A new rule within Akamai App & API Protector has been deployed to protect our customers from this WordPress threat, complementing the SQL injection coverage that was already in place.
Although web application firewall (WAF) rules can identify and block known exploit patterns, the most effective defense is to promptly apply the patches provided by the vendor. Given the severity of this issue and the large number of global WordPress installations, administrators should apply updates immediately.
The Akamai Security Intelligence Group will continue to monitor, report on, and create mitigations for threats such as these for both our customers and the security community at large. To keep up with more breaking news from the Akamai Security Intelligence Group, check out our research home page and follow us on social media.
Tags
