[July 2026 Vulnerability-Based Attack Detection Bulletin] (CVE-2026-63030 / CVE-2026-60137)

公開日：2026年8月4日

Threat Intelligence Group Security Engineer

Yamaki Yuto

Cyber Security Cloud, Inc. (Headquarters: Shinagawa-ku, Tokyo; Representative Director, President and CEO: Toshihiro Koike; hereinafter referred to as "the Company"), a global security manufacturer, is releasing an "Attack Detection Bulletin" regarding the WordPress core vulnerability chain "wp2shell" (CVE-2026-63030 / CVE-2026-60137), for which a patched version was released on July 17, 2026 (July 18, Japan time). The report compiles attack detection data observed since the public announcement and analyzes it along with the technical structure of the vulnerability. On the day the patched version was released, communications directed to the batch endpoint observed by the Company surged from 17 the previous day to 4,704, an increase of approximately 277 times, and a total of approximately 1.95 million incidents were detected over the following nine days. This report analyzes this surge based on actual measurement data and the significant discrepancies in CVSS scores among different evaluation organizations, based on the Company's observations.

 

≪Report Summary≫

• Between July 18, 2026 (the day wp2shell was announced) and July 26, 2026 (a total of 9 days), we detected a total of 1,950,165 communications destined for the batch endpoint.
• On the day of the announcement, the number of detected cases reached 4,704, a sharp increase of approximately 277 times compared to the previous day (17 cases). The daily average over the nine-day period reached approximately 217,000 cases.
• While the United States accounts for 30.9% of attack origins, a trend of numerous IPs connecting in a distributed manner has been observed in several countries, including Japan, suggesting that source-based defenses alone may not be sufficient to cope.
• CVE-2026-60137, which forms the core of the chain, is rated 5.9 (MEDIUM) by CNA (WPScan), while CISA-ADP rates it 9.1 (CRITICAL), indicating a significant difference in severity ratings among authoritative rating agencies.

 

■ Trends in the number of detections

Target:Requests that suggest the misuse of wp2shell among communications destined for the batch endpoint.
Period:Daily trends are from 2026/07/01 to 2026/07/26. Analysis of source IPs is limited to the period after publication, from 2026/07/18 to 2026/07/23.
Unit:Each log line is counted as one request. The success or failure of the attack is irrelevant; only attempts that reached a certain point are counted.

Prior to the public announcement, from July 1st to July 17th, the median number of cases per day was only 7, with an average of 22.2 cases, and the total for the 17 days was 378.
However, on July 18th, the day the revised version was released, 4,704 cases were detected, a sharp increase of approximately 277 times compared to the previous day (17 cases). The number of cases remained high thereafter, reaching a peak of 576,756 on July 26th, and a cumulative total of 1,950,165 cases over the nine days from July 18th to July 26th, averaging approximately 217,000 cases per day.

 

■ Trends in the origin of attacks

When viewed by country, the total number of accesses and the number of unique IP addresses show different trends.

Table 1: Number of accesses and unique IP addresses by country/region (July 18-23, 2026)
country	Total number of items	Composition ratio	Number of unique IP addresses	Per IP Average number of accesses
America	225,742	30.93%	948	238.1
Germany	96,720	13.25%	277	349.2
Japan	68,771	9.42%	984	69.9
Lithuania	53,794	7.37%	13	4,138.0
Singapore	48,520	6.65%	467	103.9
Indonesia	46,061	6.31%	171	269.4
Netherlands	32,179	4.41%	367	87.7
Switzerland	30,433	4.17%	93	327.2
Italy	17,060	2.34%	93	183.4
Hong Kong	16,731	2.29%	74	226.1
France	9,201	1.26%	141	65.3
Russia	8,183	1.12%	7	1,169.0
England	3,352	0.46%	97	34.6
64 other countries and regions	73,065	10.01%	561	130.2

* "Total number of attempts" refers to the number of attempts reached, and "Number of unique IPs" refers to the number of unique IPs that could be matched with the IP information database (matching rate approximately 95%).

In terms of total access, the United States stands out with 225,742 visits, accounting for 30.9% of the total, followed by Germany at 13.3%, Japan at 9.4%, and Lithuania at 7.4%. The top 10 countries and regions account for 87.1% of the total, indicating that the number of visits is concentrated in a limited number of countries.

On the other hand, the picture changes when we look at the average number of connections per IP address. Lithuania has 53,794 connections with just 13 IP addresses (4,138 connections per IP address), and Russia has 8,183 connections with 7 IP addresses (1,169 connections per IP address), showing a concentration on a small number of hosts. In contrast, Japan has only 68,771 connections with 984 IP addresses (69.9 connections per IP address), resulting in a distribution where many IP addresses connect in small amounts.

In countries like Lithuania and Russia, where traffic is concentrated on a small number of hosts, source-based blocking may temporarily function effectively. On the other hand, in countries like Japan, where a large number of IPs are distributed, the blocking list may not be able to keep up with updates. This suggests that source-based defenses alone may not be sufficient, and a mechanism for making decisions based on the request content is necessary.

 

■ Anomaly detection analysis

The revised version was released on July 18th Japan time, and attacks using the publicly available Proof of Concept (PoC) began to be observed on the same day. The surge from 17 attacks the previous day to 4,704 attacks suggests that automated scanning and attack tools may have been deployed in a short period of time after the PoC was released.

Furthermore, Japan was on a three-day holiday from July 18th to 20th, and the attacks intensified during that period. This incident suggests that it is necessary to review the operational system to ensure that emergency response measures are not dependent on specific days of the week or time slots.

 

■ Points that are difficult to measure with scores

CVE-2026-60137, which is at the core of the chain and is actually responsible for data extraction, was rated 5.9 (MEDIUM) by CNA (WPScan) at the time of publication. Since the 6.8 series is not affected by CVE-2026-63030 and is solely affected by CVE-2026-60137, it was in a situation where addressing it could be delayed in a CVSS-based prioritization process.

Furthermore, CISA-ADP rated the same CVE as 9.1 (CRITICAL), indicating a 3.2-point, two-level severity discrepancy between authoritative rating agencies for the same vulnerability. This can be seen as an example of the limitations of triage based on a single score.

 

■ About wp2shell (Technical background of the vulnerability)

On July 17, 2026 (July 18, Japan time), a vulnerability in the WordPress core that could lead to pre-authenticated remote code execution (pre-auth RCE) was disclosed. The entire attack chain has been named "wp2shell" by the discoverer, Searchlight Cyber.
CVE-2026-63030 was reported by Adam Kues (Assetnote / Searchlight Cyber), and CVE-2026-60137 was reported by TF1T, dtro, and haongo.

Route confusion in REST batch endpoints (CVE-2026-63030)
`/wp-json/batch/v1` is a mechanism that processes multiple REST subrequests in a single HTTP request. Internally, validation and dispatch are handled in separate loops, and if the function responsible for resolving the subrequest path (`wp_parse_url()`) fails, the error is only added to the validation array and not reflected in the dispatch array. This asymmetry means that subrequests may be dispatched by a different handler than intended, potentially bypassing the authentication blocklist that protected the vulnerable code path of WP_Query.

 

SQL injection vulnerability using author__not_in (CVE-2026-60137)
The `author__not_in` parameter of `WP_Query` is implemented assuming it accepts an array, and the validation logic checks if it is an array before proceeding with sanitization. If a string is passed instead of an array, this type check is skipped entirely, and the value under the attacker's control is directly interpolated into the SQL query. Its key feature is that it only results in information leakage.

 

Attack chain flow

Using these two security vulnerabilities, an attacker could carry out an attack in the following sequence. In this case, we assume that the attacker extracts authentication information, such as the administrator's password hash, as confidential information.

• Unauthenticated Request
• CVE-2026-63030: Root confusion in /wp-json/batch/v1 bypasses permission checks.
• CVE-2026-60137: An SQL query with the error `author__not_in` is triggered, extracting sensitive information (such as the administrator's password hash).
• After offline analysis of extracted authentication information, administrative privileges are obtained.
• Uploading malicious plugins/web shells
• The expected sequence of events is arbitrary code execution on the server.

Table 2: Scope of impact and patch versions of vulnerabilities in wp2shell
branch	Affected versions	CVE-2026-63030	CVE-2026-60137	wp2shell	Revised version
7.0.x	7.0.0 – 7.0.1	Established	Established	Established	7.0.2
6.9.x	6.9.0 – 6.9.4	Established	Established	Established	6.9.5
6.8.x	6.8.0 – 6.8.5	Not established	Conditional	Not established	6.8.6
6.7 and earlier	—	Not established	Not established	Not established	—

* Although 6.8.x is not affected by CVE-2026-63030 and therefore does not function as wp2shell (RCE chain), it is affected by CVE-2026-60137 (SQL injection alone), so an update to 6.8.6 is required.

 

■ Recommended actions

This vulnerability chain can occur even with unauthenticated and default configurations, so if you are using an affected WordPress installation, please prioritize considering the following actions.
Version check and update: Please promptly update from 7.0.0 to 7.0.1 to 7.0.2, from 6.9.0 to 6.9.4 to 6.9.5, and from 6.8.0 to 6.8.5 to 6.8.6.
Automatic Update Application Verification: WordPress.org has enabled mandatory automatic updates for this issue, but please verify individually whether they were actually applied.
Temporary workaround if immediate updates are difficult: Unauthenticated access to /wp-json/batch/v1Please restrict access using WAF (Web Application Firewall) or web server settings.
Checking for compromise: Check both logs and the file system for the presence of suspicious administrator accounts, unfamiliar plugins, and files that appear to be web shells.
Log preservation: Preserve access logs to the batch endpoint and make them available for investigation as needed.
If you suspect infringement, please consider consulting a professional.

 

■ Reference information

1. WordPress 7.0.2 Release. WordPress.org Official, July 17, 2026.
2. GHSA-ff9f-jf42-662q (REST batch route confusion). GitHub Security Advisory.
3. GHSA-fpp7-x2x2-2mjf (SQL Injection in author__not_in). GitHub Security Advisory.
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-63030 / CVE-2026-60137). Published by CISA on July 21, 2026.
5. CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core. Rapid7 Blog.
6. WordPress Exploitation Underway CVE-2026-63030. SANS Internet Storm Center.
7. Our company's warning. Cyber Security Cloud, Inc., July 21, 2026.

 

■ Update History

August 4, 2026: Newly released

 

Cyber Security Cloud, Inc. (https://www.cscloud.co.jp)

Address: 13th Floor, JR Tokyu Meguro Building, 3-1-1 Kami-Osaki, Shinagawa-ku, Tokyo 141-0021, Japan
Representative: Toshihiro Koike Representative Director, President and CEO
Established: August 2010
With the mission of "creating a safe and secure cyberspace for people all over the world," we are a Japanese security manufacturer that provides web application security services utilizing world-leading cyber threat intelligence, as well as vulnerability information collection and management tools and fully managed security services for cloud environments. As one of the global companies in cybersecurity, we will contribute to solving social issues related to cybersecurity and providing added value to society.

 

[Disclaimer]

This information is compiled for informational purposes only, based on publicly available information and our own research. While we strive to ensure accuracy, we do not guarantee its completeness, and it may change depending on future circumstances. Please consult other official sources before making any decisions.