Exploit / PoCcritical

Attackers Can Take Over WordPress Sites Using Newly Released wp2shell Exploits

Security Affairsby @securityaffairsJul 19, 2026 · 05:04 UTC (Jul 19, 2026)2 min read1 · 1 read

Read at securityaffairs.com

Analyze CVE-2026-63030 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2026-63030 CVE-2026-60137

Tags: cve-2026-60137 cve-2026-63030 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-63030 +1 related CVE CVE-2026-60137	WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE	9.8 group max	11%	KEVPoC ×9	Jul 17, 2026 KEV Jul 21, 2026

From the original article

2 min read at securityaffairs.com

Public exploits are now available for two critical WordPress flaws that attackers can chain to gain remote code execution without authentication. Public proof-of-concept exploits are now available for the critical wp2shell vulnerabilities affecting WordPress Core.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.