Symbiotic Security details WordPress core RCE chain SAST missed

Symbiotic Security published an analysis on July 28, 2026 showing how two WordPress core bugs can combine into unauthenticated remote code execution. The finding matters because the chain hits WordPress core itself and exposes a blind spot in static analysis tools that inspect code one file at a time.

Why it matters: - WordPress powers 59.1% of all sites whose CMS is known, or about 41.2% of the entire web, according to W3Techs. - A flaw in WordPress core affects far more sites than a plugin or theme issue. - The chain leads to unauthenticated remote code execution, one of the most serious remote application flaws. - The vulnerability is notable because unauthenticated RCE is rare in WordPress core.

What happened: - Symbiotic Security published a technical analysis on July 28, 2026 of WP2Shell, a two-vulnerability chain in WordPress core. - The chain combines CVE-2026-60137 and CVE-2026-63030. - In combination, the bugs turn an unauthenticated SQL injection into unauthenticated remote code execution. - The research argues that static analysis tools miss the chain because the weakness only appears when multiple components interact across files and execution phases.

The details: - The SQL injection sink lives in WP_Query. - WordPress core does not normally supply a scalar author__not_in value, so the sink appears unreachable in isolation. - The batch REST endpoint bug initially looks like a routing issue. - An attacker can combine the bugs to manufacture a scalar author__not_in string that activates the SQL injection sink. - The enabler is a batch dispatcher desynchronization. - The endpoint validates requests under one schema in one pass, then executes them under a different handler in a second pass. - A malformed path inserts an error object into the request and validation lists but not the match list. - That shifts handler mapping by one and allows a request to be sanitized under one schema and executed under another. - The full technical write-up is available at the full technical write-up.

Between the lines: - Edouard Viot, co-founder and CTO at Symbiotic Security, said very few security scanners can detect this kind of vulnerability. - The case underscores a structural limitation in SAST: tools are strong at source-to-sink paths and missing sanitizers, but weak at relational invariants and runtime mapping across files. - WP2Shell is a composition bug, so each half looks defensible on its own. - The risk only becomes visible when the two parts are combined at runtime.

What's next: - Security teams are being pushed toward defense-in-depth instead of relying on post-commit scanning alone. - Recommended defenses include normalizing ID lists at the sink on both scalar and array paths. - Teams should ban raw SQL concatenation into wpdb queries and use prepare or parameterized builders. - Schema-validated inputs should be treated as untrusted again at execution boundaries. - Custom scanner rules should act as guardrails, not as the main way to discover unknown chains. - Enforcement should move earlier so unsafe patterns are prevented during coding rather than flagged after the fact.

The bottom line: - WP2Shell is a reminder that two individually safe-looking bugs can still combine into critical RCE, and that one-file-at-a-time scanning can miss the chain.