CVE-2026-63030

Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. [...] [xlite_meta score:67 src:BleepingComputer xlite_fp:11da5a5adadd21c5343b4efba73a3c21da8d1d354237850f17a90ba1139e1121]

Serial number: AV26-723 Date: July 20, 2026 Date: July 21, 2026 On July 17, 2026, WordPress published a security advisory to address vulnerabilities in the following product: WordPress 7.0 – versions prior to 7.0.2 WordPress 6.9 – versions prior to 6.9.5 WordPress 6.8 – versions prior to 6.8.6 WordPress 7.1 beta – versions prior to 7.1 beta2 Open-source reporting indicates that CVE-2026-60137 and CVE-2026-63030 are being exploited in the wild. Update 1 On July 21, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-60137 and CVE-2026-63030 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates. Facilitated SQL injection vulnerability in the `author__not_in` parameter of `WP_Query` REST API batch-route confusion and SQL injection issue leading to Remote Code Execution WordPress 7.0.2 Release WordPress Releases CISA KEV: CVE-2026-60137 CISA KEV:

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability CVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability CVE-2026-63030 WordPress Core Interpretation Conflict Vulnerability CVE-2026-60137 WordPress Core SQL Injection Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-0 [xlite_meta score:67 src:CISA Alerts xlite_fp:524ce280233a6c7753b9d67606f44af5483b28ffc6ac6e16f8dec48bda5d4aa8]

Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites. The two security flaws, tracked as CVE-2026-63030 and CVE-2026-60137, have been codenamed wp2shell. "By the early hours of Saturday morning (UTC), successful exploitation was already well [xlite_meta score:53 src:The Hacker News xlite_fp:4b7432541814038aacf6668495e152b9d9e514ba56060d9d8df008d6d45c431c]

Barely three days after disclosure, attackers are widely chaining together CVE-2026-60137 and CVE-2026-63030 to lob exploit attempts against one of the largest attack surfaces on the Internet.

Last week, Searchlight Cyber released details about a vulnerability they are calling "wp2shell". The vulnerability was initially announced without a CVE number. But now has been assigned CVE-2026-63030. Many WordPress plugin vulnerabilities are never assigned CVE numbers. But wp2shell is different. It is a SQL injection vulnerability in WordPress Core, not a plugin, and can lead to unauthenticated remote code execution. Shortly after being announced, the vulnerability started to be exploited. [xlite_meta score:57 src:SANS ISC xlite_fp:3d523abf28be44196ee56ce38d1033fd345a12797cc10c90b9292c0f87090972]

Exploitation of the new WordPress vulnerabilities tracked as CVE-2026-60137 and CVE-2026-63030 started soon after disclosure. The post WP2Shell WordPress Vulnerabilities Exploited in the Wild appeared first on SecurityWeek. [xlite_meta score:53 src:SecurityWeek xlite_fp:b33b7169127854335c535469f99554c9db66ac7c4c58a0cc72043f936cd255bf]

Overview On July 17, 2026, a GitHub Security Advisory was published for CVE-2026-63030, a critical unauthenticated remote code execution vulnerability affecting WordPress Core. While the official GitHub security advisory classifies the severity as Critical, the vulnerability has currently been assigned a CVSS score of 7.5. WordPress is one of the most widely deployed content management systems, making vulnerabilities in its core software potentially significant for organizations operating public-facing websites. The vulnerability reportedly allows an unauthenticated attacker to execute code via the WordPress REST API batch endpoint, potentially resulting in complete compromise of the website and its underlying data. No valid account or user interaction is required. According to the advisory, the vulnerability affects WordPress versions 6.9.0 through 6.9.4 and versions 7.0.0 through 7.0.1. The issue is fixed in WordPress 6.9.5 and 7.0.2. A fix is also included in WordPress 7.1 Beta 2. C