Anatomy of a 90-Minute WordPress Core RCE Exploitation Campaign

When security advisories for critical software components are published, the common refrain is always to update immediately. In practice, however, defenders face an industrialized threat landscape where automated scanners monitor core repositories for vulnerability patches. This timeline was demonstrated following the disclosure of a pre-authentication remote code execution (RCE) chain affecting WordPress core.

Within ninety minutes of the official release tag, telemetry systems intercepted live exploitation traffic. Over subsequent days, security sensors blocked more than 65,000 exploitation attempts originating from over 1,500 distinct IP addresses. This operational review analyzes how the vulnerability functions, the structure of the attack traffic, and the critical lessons learned regarding Web Application Firewall (WAF) rule efficacy.

The Technical Anatomy of the Vulnerability Chain

The incident relied not on a single flaw, but on a two-part vulnerability chain that bridged a read-only database query issue with REST API handler confusion:

• CVE-2026-60137: A facilitated SQL injection vector residing within WP_Query via the author_exclude (and variants like author__not_in) parameter. This affects WordPress versions 6.8 through 7.0.1.
• CVE-2026-63030: A route and handler confusion flaw within the REST API batch endpoint (/batch/v1). This affects versions 6.9 through 7.0.1.

Independently, neither bug yields immediate code execution. The SQL injection is confined to a SELECT context, meaning it can read data but not write to the database. The batch confusion does not natively hand an attacker an authenticated administrator session. However, when chained together, the batch endpoint permits an unauthenticated payload to bypass standard input sanitation schemas, smuggling the SQL injection and ultimately automating the provisioning of a new administrative account.

Both vulnerabilities were remediated in WordPress core versions 7.0.2, 6.9.5, and 6.8.6. Code audits verified that legacy branches prior to 6.8 (such as 6.1 or 6.2) are entirely unaffected because the vulnerable parameter handling and batch desync mechanics did not exist in those codebases.

The 90-Minute Exploitation Window

The core fix was committed to the WordPress trunk approximately 90 minutes before version 7.0.2 was officially tagged. For automated actors, the public commit diff serves as an immediate disclosure mechanism. Real-world exploitation attempts hit perimeter sensors just 90 minutes after the release of 7.0.2, translating to roughly three hours after the initial code commit.

This narrow window underscores the inadequacy of manual patching cadences against automated adversaries. The traffic profile during the initial ramp-up exhibited characteristics of uncoordinated scanning tools and framework integration:

• Traffic originated from more than 1,500 unique source IPs, heavily concentrated within cloud and VPS hosting ranges (such as Vultr/Choopa and M247).
• The highest-volume single network accounted for only 6.45% of total requests, confirming a decentralized wave of independent operators rather than a single unified botnet.
• The majority of early telemetry captured reconnaissance probes rather than completed payloads, though specialized actors quickly moved past enumeration to direct administrative account generation.

Payload Evolution and Delivery Vectors

Analysis of the intercepted request bodies revealed that 97% of blocked traffic targeted the REST batch endpoint. Attackers invoked this endpoint using both standard routing conventions and URI variants designed to slip past rudimentary string matches:


/?rest_route=/batch/v1
/wp-json/batch/v1
/index.php?rest_route=/batch/v1
/wp/?rest_route=/batch/v1


The malicious logic was frequently concealed within nested JSON arrays inside the batch request body, obscuring it from basic edge inspection engines. Approximately three-quarters of these requests injected payloads into the author_exclude parameter (along with normalizations like author.exclude). These payloads leveraged common evasion techniques, including inline MySQL comments, case mutation, and conditional sleep functions:


AND (1=1)
AnD (1=1)
AND/**/(1=1)
/*!AND*/
OR SLEEP(5)
UNION SELECT


Full-Chain Exploitation: From Sqli to RCE

While the vast majority of observed traffic consisted of automated boolean and time-based SQL injection validation probes, a smaller subset of actors executed the complete privilege escalation chain. These actors utilized tools informally tracked as wp2shell.

The complete exploit leverages the forged database output to seed customized post entries and transients, establishing a new administrative user via a nested REST API call:

{
  "method": "POST",
  "path": "/wp/v2/users",
  "body": {
    "username": "attacker_user",
    "email": "compromise@target.local",
    "password": "strong_pass_here",
    "roles": ["administrator"]
  }
}

Once administrative privileges are established via this mechanism, attackers execute standard post-compromise actions: logging into the dashboard, uploading a malicious plugin designed to act as a web shell, and executing arbitrary PHP code on the underlying operating system.

WAF Rule Bypasses: The URL Inspection Blind Spot

A critical technical finding during the incident response phase involved the limitations of early Web Application Firewall mitigations. Nearly all security vendors deployed rules that keyed exclusively on the request URL—specifically searching for patterns like batch/v1 in the URI path or query string.

This approach contained a fundamental design flaw. WordPress registers rest_route as a public query variable and evaluates incoming requests by reading parameters from the HTTP POST body before processing query strings. Consequently, an attacker can dispatch a standard POST / request containing:


rest_route=/batch/v1


included directly within the form-encoded or JSON POST body alongside the attack payload. Because the URL path remains pristine (e.g., pointing strictly to the site root), perimeter WAF rules targeting URL strings fail to flag the traffic, routing the payload directly to the vulnerable endpoint.

Telemetry confirmed that attackers rapidly transitioned to this delivery method once initial URL-based signatures were deployed globally. Effective mitigation requires rules to inspect both URL paths and POST/JSON bodies for parameter registration anomalies.

Indicator of Compromise (IoC) and Forensics Checklist

Administrators managing potentially exposed instances should perform deep forensic checks against server logs and the filesystem using specific indicators:

• Log Analysis: Search access logs for calls to the batch endpoint across all variants (/wp-json/batch/v1, ?rest_route=/batch/v1) and inspect POST bodies for embedded rest_route declarations.
• Parameter Inspection: Flag non-integer values within author_exclude, author.exclude, or related query parameters containing SQL keywords like UNION, SLEEP, or inline comments.
• REST Sub-Requests: Check for unauthorized invocation of privileged routes within batch payloads, specifically POST /wp/v2/users adding administrator roles or unauthorized calls to /wp/v2/plugins.
• Filesystem Audit: Scan wp-content/uploads/, wp-content/plugins/, and particularly wp-content/mu-plugins/ for unrecognized PHP scripts, backdoors, or stray drop-in files.

Practical Implementation and Mitigation Strategies

The velocity of this campaign validates the necessity of defense-in-depth strategies. Relying solely on scheduled update cycles leaves a dangerously wide exposure window when patches are weaponized within hours.

1. Immediate Core Update: Upgrade all instances immediately to WordPress 7.0.2, 6.9.5, or 6.8.6.
2. Virtual Patching: Deploy application-aware firewalls capable of inspecting deep request bodies rather than surface-level uniform resource locators.
3. Access Restriction: Limit exposure of the WordPress REST API endpoint to authenticated administrative networks where public access is not strictly required by frontend functionality.

Primary reference: Review the original announcement for exact release details. This article is an independent explanation and does not reproduce the source text.