WordPress's Two-Bug Combo: What the wp2shell RCE Teaches Us About Code Review

Security researchers at Searchlight Cyber discovered a serious vulnerability affecting WordPress, the platform powering roughly half of all websites on the internet. The flaw allows attackers to remotely execute code on vulnerable sites without needing any login credentials, making it a significant risk for site owners.

The issue arises from two separate vulnerabilities working together. The first, tracked as CVE-2026-63030, is a flaw in how WordPress's REST API batch endpoint matches and validates sub-requests, causing some requests to be checked against one set of rules but processed using another. The second, CVE-2026-60137, is a SQL injection flaw in WordPress core caused by incomplete input sanitisation in a database query parameter. On its own, the SQL injection issue would not normally be exploitable on a standard WordPress install, but the REST API flaw provides attackers a way to smuggle unsanitised data through to trigger it, creating a serious combined risk.

The research also raises a broader question for the security community: despite years of effort to catch vulnerabilities earlier in the development process, would today's code review and automated scanning tools have actually caught this issue before it shipped. This case highlights how vulnerabilities that seem harmless in isolation can become dangerous when chained together.