WP2Shell Fixer

Standalone mitigation plugin for two actively exploited WordPress vulnerabilities (CISA catalog). Deploy on sites that cannot be updated yet to a patched core (6.8.6 / 6.9.5 / 7.0.2). Compatible with PHP 5.6+ and old WordPress versions.

This plugin is a temporary band-aid. The real fix remains updating WordPress. Remove the plugin once the core is updated.

Covered vulnerabilities

CVE	Vulnerability	Applied mitigation
CVE-2026-60137	SQL injection via author__not_in in WP_Query (CWE-89)	Coerces author__in / author__not_in to positive integers via pre_get_posts (priority 0) and the request filter, before the SQL is built.
CVE-2026-63030	REST API batch endpoint route confusion (CWE-436), chained to RCE	Unregisters the /batch/... routes (rest_endpoints) and blocks any dispatch to /batch/ with a 403 (rest_pre_dispatch).

Installation

Drop the wp2shell-fixer.php file into wp-content/plugins/, then activate "WP2Shell Fixer" in the admin, or via WP-CLI:

wp plugin activate wp2shell-fixer

No configuration required.

Re-enabling the batch endpoint (rare)

The batch endpoint is mostly used by the block editor for grouped saves. If you really need it, add this in a mu-plugin:

add_filter( 'wp2shell_fixer_disable_batch', '__return_false' );

Tests

• PHP 5.6 compatibility (syntax + runtime + logic):

  docker run --rm --platform linux/amd64 -v "$PWD":/app -w /app tetraweb/php:5.6 \
    php test/php56-compat.php

• Behavior on a real WordPress (WP 5.8 + WP-CLI via Docker):

  bash test/run-tests.sh

Both suites must print "ALL TESTS PASS".