"WP2Shell" Critical WordPress RCE Chain (CVE-2026-63030 & CVE-2026-60137)
Found by web discovery while looking for coverage of CVE-2026-60137
CISA added the WordPress core pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137) to KEV after confirmed exploitation; WordPress 6.9.5 and 7.0.2 fix the flaws.
On July 17, 2026 WordPress disclosed CVE-2026-63030, a REST API route-confusion flaw, and CVE-2026-60137, a SQL injection in WP_Query, which chain to unauthenticated remote code execution on default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. CISA has added both to the Known Exploited Vulnerabilities Catalog and active exploitation is confirmed. Cloudflare deployed WAF rules at 17:03 UTC on July 17, and patches are available in WordPress 6.9.5 and 7.0.2.
- Chain: REST API route confusion (CVE-2026-63030) plus SQLi (CVE-2026-60137) yields pre-auth RCE
- CISA added both CVEs to the KEV catalog after confirmed exploitation
- Mitigations: block anonymous REST API access or deploy Cloudflare managed WAF rules
- WordPress 6.8.0-6.8.5 exposed to SQLi only; 6.9.0-6.9.4 and 7.0.0-7.0.1 to full RCE
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-63030+1 related CVE | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE | 9.8 group max | 11% | KEVPoC ×9 | KEV |
From the original article
3 min read at labs.beazley.security
WordPress disclosed CVE-2026-60137 and CVE-2026-63030 together on July 17, active exploitation has now been confirmed for both CVEs. Organizations using WordPress should treat this as a critical, actively exploited vulnerability and prioritize patching.
labs.beazley.security
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.