Exploit / PoCcriticalExploited in the wild

New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

The Hacker Newsby @TheHackersNewsJul 18, 2026 · 05:23 UTC (Jul 18, 2026)5 min read2 · 1 read

Read at thehackernews.com

Analyze CVE-2026-63030 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2026-63030 CVE-2026-60137

Tags: cve-2026-60137 cve-2026-63030 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-63030 +1 related CVE CVE-2026-60137	WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE	9.8 group max	11%	KEVPoC ×9	Jul 17, 2026 KEV Jul 21, 2026

From the original article

5 min read at thehackernews.com

Updated July 18, 2026: the two flaws now carry CVE IDs, the full mechanism has been published, a persistent-object-cache condition has surfaced, and a working proof-of-concept is public. The story below reflects all of it. An anonymous HTTP request can run code on a WordPress site.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.