WP2Shell: Hands-On Lab Reproducing the Pre-Auth WordPress Core RCE
WP2Shell is a hands-on lab demonstrating a pre-authentication remote code execution (RCE) vulnerability in WordPress core. The lab reproduces the exploit chain starting from an unauthenticated request leading to RCE, involving a read-only SQL injection that is escalated to code execution using legitimate WordPress features. The original vulnerability research is attributed to Adam Kues at Searchlight Cyber. No affected versions or patches are explicitly stated in the available information.
AI Analysis
Technical Summary
This threat involves a pre-authentication remote code execution vulnerability in WordPress core, identified as CVE-2026-63030 and CVE-2026-60137. The exploit chain begins with a read-only SQL injection that is leveraged through multiple steps involving WordPress internal features to achieve code execution without authentication. The WP2Shell lab reproduces this complex chain on WordPress version 7.0.1 to aid understanding of the vulnerability. The source is a Reddit post linking to a detailed lab by a security researcher, but no official vendor advisory or patch information is provided.
Potential Impact
Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the WordPress server, potentially leading to full system compromise. The vulnerability affects WordPress core and can be exploited remotely without authentication. However, the exploit chain is complex, involving multiple steps and leveraging legitimate WordPress features.
Mitigation Recommendations
Patch status is not yet confirmed — check the official WordPress vendor advisory for current remediation guidance. Until an official fix is available, monitor vendor channels for updates. No direct mitigation steps are provided in the available information.
WP2Shell: Hands-On Lab Reproducing the Pre-Auth WordPress Core RCE
Description
WP2Shell is a hands-on lab demonstrating a pre-authentication remote code execution (RCE) vulnerability in WordPress core. The lab reproduces the exploit chain starting from an unauthenticated request leading to RCE, involving a read-only SQL injection that is escalated to code execution using legitimate WordPress features. The original vulnerability research is attributed to Adam Kues at Searchlight Cyber. No affected versions or patches are explicitly stated in the available information.
Reddit Discussion
When the WP2Shell writeup came out recently (unauth RCE in WordPress core, CVE-2026-63030 + CVE-2026-60137), I read it a few times and still couldn't really understand the whole chain in my head. I personally don’t have a lot of experience with WP internals, so I had a lot of “whys” when reading it. The way I usually deal with that is to just try to reproduce the thing to see how it works.
I then turned it into a full lab that has a WordPress 7.0.1 app and steps through the entire chain from an unauthenticated request to RCE.
Honestly it was more work than I expected. The SQL injection is read-only, so a good amount of the exploiting part is dedicated to finding a way to turn that SQLi into an actual write. It uses a bunch of WP legitimate features that I had no idea about, so reproducing each hop reliably took a while.
I built it mostly for my own understanding, but made it available for free in case anyone else is struggling to understand the middle part of the exploit. Original research is Adam Kues at Searchlight Cyber, I recommend reading his article if you haven't done so already.
Link to the lab (it doesn’t work on mobile, you’ll need a desktop device): https://learn.uphack.io/lab/wp2shell-wordpress-rce
Links cited in this discussion
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This threat involves a pre-authentication remote code execution vulnerability in WordPress core, identified as CVE-2026-63030 and CVE-2026-60137. The exploit chain begins with a read-only SQL injection that is leveraged through multiple steps involving WordPress internal features to achieve code execution without authentication. The WP2Shell lab reproduces this complex chain on WordPress version 7.0.1 to aid understanding of the vulnerability. The source is a Reddit post linking to a detailed lab by a security researcher, but no official vendor advisory or patch information is provided.
Potential Impact
Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the WordPress server, potentially leading to full system compromise. The vulnerability affects WordPress core and can be exploited remotely without authentication. However, the exploit chain is complex, involving multiple steps and leveraging legitimate WordPress features.
Mitigation Recommendations
Patch status is not yet confirmed — check the official WordPress vendor advisory for current remediation guidance. Until an official fix is available, monitor vendor channels for updates. No direct mitigation steps are provided in the available information.
Technical Details
- Source Type
- Subreddit
- cybersecurity
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Domain
- null
- Newsworthiness Assessment
- {"score":30,"reasons":["external_link","newsworthy_keywords:rce","established_author","very_recent"],"isNewsworthy":true,"foundNewsworthy":["rce"],"foundNonNewsworthy":[]}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6a5fb2d62a4a8d5989888748
Added to database: 07/21/2026, 17:56:38 UTC
Last enriched: 07/21/2026, 17:56:44 UTC
Last updated: 07/21/2026, 20:50:08 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.