--- title: WordPress Core "wp2shell" RCE flaws get public exploits,... description: Two critical WordPress Core vulnerabilities, collectively dubbed 'wp2shell' (CVE-2026-63030 and CVE-2026-60137), can be chained to achieve pre-authentication... canonical: https://daily.dev/posts/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now-ks4kuieab twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: WordPress Core "wp2shell" RCE flaws get public exploits, patch now | daily.dev og:description: Two critical WordPress Core vulnerabilities, collectively dubbed 'wp2shell' (CVE-2026-63030 and CVE-2026-60137), can be chained to achieve pre-authentication... og:url: https://daily.dev/posts/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now-ks4kuieab og:image: https://api.daily.dev/og/posts/Ks4kUieAB.png og:image:alt: WordPress Core "wp2shell" RCE flaws get public exploits, patch now og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # WordPress Core "wp2shell" RCE flaws get public exploits, patch now **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 5 min read · 0 upvotes · 0 comments ## Summary Two critical WordPress Core vulnerabilities, collectively dubbed 'wp2shell' (CVE-2026-63030 and CVE-2026-60137), can be chained to achieve pre-authentication remote code execution on default WordPress installations running versions 6.9.x and 7.0.x. The first flaw is a REST API batch-route confusion bug introduced in 6.9, and the second is a SQL injection vulnerability in the WP_Query 'author__not_in' parameter. Public proof-of-concept exploits are now available on GitHub, and in-the-wild exploitation has been reported. WordPress has pushed forced automatic updates to affected sites; administrators should update to 7.0.2 or 6.9.5 immediately. Temporary mitigations include blocking REST API batch routes at the WAF level or restricting anonymous REST API access. Cloudflare has deployed WAF rules for all plans. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [wp2shell: WordPress Patches a Pre-Auth RCE That Needed No Plugins](https://daily.dev/posts/wp2shell-wordpress-patches-a-pre-auth-rce-that-needed-no-plugins-pmh9adxqu) · Latest Hacking News · 2 upvotes · 0 comments - [WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments](https://daily.dev/posts/wordpress-comment2shell-xss-to-rce-chain-lets-unauthenticated-attackers-compromise-servers-via-mal-8wlrbsg8k) · Orca Security Blog · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#sql](https://daily.dev/tags/sql), [#wordpress](https://daily.dev/tags/wordpress) [View this post on daily.dev](https://daily.dev/posts/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now-ks4kuieab) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"WordPress Core \"wp2shell\" RCE flaws get public exploits, patch now","url":"https://daily.dev/posts/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now-ks4kuieab","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now-ks4kuieab"},"datePublished":"2026-07-18T17:27:14.752Z","dateModified":"2026-07-20T13:33:39.074Z","description":"Two critical WordPress Core vulnerabilities, collectively dubbed 'wp2shell' (CVE-2026-63030 and CVE-2026-60137), can be chained to achieve pre-authentication...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8004c01675e2a0c45eb028fe0fb3c319?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8004c01675e2a0c45eb028fe0fb3c319?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now-ks4kuieab","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,sql,wordpress","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"WordPress Core \"wp2shell\" RCE flaws get public exploits, patch now"}]} ```