Critical wp2shell RCE Vulnerability

Cybersecuritynews •Guru Baran • July 20, 2026

Overview A critical pre-authentication remote code execution (RCE) vulnerability chain nicknamed “wp2shell” has been disclosed in WordPress Core, putting an estimated 500 million-plus websites at risk of full takeover by completely unauthenticated attackers. The chain combines two separately tracked flaws CVE-2026-63030, a REST API batch-route confusion issue, and CVE-2026-60137, a SQL injection vulnerability in the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical wp2shell Vulnerability Enables Unauthenticated RCE in WordPress A critical vulnerability chain, dubbed wp2shell, has been identified in WordPress Core, allowing unauthenticated attackers to execute arbitrary code on default installations. This vulnerability is tracked as CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection). Exploitation can occur via a single anonymous HTTP request, impacting WordPress versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1. Security teams are urging immediate updates to versions 6.9.5 and 7.0.2 to mitigate risks. A public proof-of-concept (PoC) is available, and while no mass exploitation has been confirmed, the risk is considered extremely high. The vulnerabilities were disclosed on July 17, 2026, and have been actively discussed in the security community. 46 sources 73

Extracted Entities

Critical wp2shell RCE Vulnerability

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)