Security researchers have discovered two vulnerabilities in WordPress that can be chained into an exploit, enabling the injection of malicious code. Administrators of the popular blog system should update quickly or apply a mini-plugin as an emergency fix.
A critical SQL injection vulnerability (CVE-2026-60137) has a CVSS score of 9.1/10 and can be exploited remotely by attackers. The vulnerability affects the author__not_in parameter of WP_Query, which is not properly validated.
The second of the two vulnerabilities was discovered by researchers from Searchlight Cyber – and, following the trend, given a nickname: “WP2Shell”. The vulnerability, identified by CVE ID CVE-2026-63030, is considered “only” a high risk on its own (CVSS 7.5/10) and is based on a flaw in the REST API of the free CMS. Little detail is known, but the API endpoint /wp-json/batch/v1 appears to be the culprit.
The finders have published a check for blog operators at wp2shell.com. It allows for an initial assessment and includes a practical fix: a WordPress plugin comprising a few lines of PHP code that secures the vulnerable API route with authentication. Those who cannot update their WordPress immediately – the recommended course of action – should use this workaround.
