Search: “cve-2026-60137”

"WP2Shell" Critical WordPress RCE Chain (CVE-2026-63030 & CVE-2026-60137)

CISA added the WordPress core pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137) to KEV after confirmed exploitation; WordPress 6.9.5 and 7.0.2 fix the flaws.

On July 17, 2026 WordPress disclosed CVE-2026-63030, a REST API route-confusion flaw, and CVE-2026-60137, a SQL injection in WP_Query, which chain to unauthenticated remote code execution on default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. CISA has added both to the Known Exploited Vulnerabilities Catalog and active exploitation is confirmed. Cloudflare deployed WAF rules at 17:03 UTC on July 17, and patches are available in WordPress 6.9.5 and 7.0.2.

Web discovery (articles for new exploits & KEV entries)·Sep 8, 16:27 UTC · 7d agoExploit / PoC in the wild 2 sourcesCVE-2026-63030CVE-2026-601371· 1 read

WordPress wp2shell Vulnerabilities Exploited in the Wild (CVE-2026 ...

Public exploit code emerged for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137); CISA set a July 24 patching deadline.

CVE-2026-63030 (REST API batch-route confusion) chained with CVE-2026-60137 (SQL injection in WP_Query's author__not_in) enables pre-authentication RCE in WordPress core, affecting versions 6.8.0-7.0.1. Multiple researchers published working PoCs on GitHub that extract password hashes, crack admin credentials, and upload malicious plugins. CISA added both CVEs to its KEV catalog with a July 24, 2026 deadline, and WordPress.org enabled forced auto-updates; fixes shipped in 6.8.6, 6.9.5, and 7.0.2.

Web discovery (articles for new exploits & KEV entries)·Sep 7, 14:13 UTC · 8d agoExploit / PoC in the wildCVE-2026-63030CVE-2026-60137

U.S. CISA adds DD-WRT, Langflow and WordPress flaws to its Known Exploited Vulnerabilities catalog

Security Affairs·Jul 22, 10:45 UTC · Jul 22, 2026Exploit / PoC in the wildCVE-2021-27137CVE-2026-0770CVE-2026-63030+1 CVEs

WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

The Hacker News·Jul 22, 15:41 UTC · Jul 22, 2026Exploit / PoC in the wildCVE-2026-63030CVE-2026-60137

⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0

The Hacker News·Jul 21, 04:34 UTC · Jul 21, 2026Vulnerability in the wildCVE-2026-63030CVE-2026-60137CVE-2026-15409+26 CVEs

Researchers Build WordPress Exploit Using OpenAI's GPT

Infosecurity Magazine·Jul 20, 14:00 UTC · Jul 20, 2026Exploit / PoC in the wildCVE-2026-63030CVE-2026-60137

Attackers Can Take Over WordPress Sites Using Newly Released wp2shell Exploits

Security Affairs·Jul 19, 05:04 UTC · Jul 19, 2026Exploit / PoCCVE-2026-63030CVE-2026-60137

July 2026 CVE Landscape

Recorded Future·Aug 7, 00:00 UTC · Aug 7, 2026Ransomware in the wildCVE-2025-3248CVE-2008-4128CVE-2017-17215+78 CVEs

Don’t swing at everything

Cisco Talos·Jul 23, 18:00 UTC · Jul 23, 2026RansomwareCVE-2026-60137CVE-2026-63030

Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication

The Hacker News·Jul 22, 15:38 UTC · Jul 22, 2026Exploit / PoC in the wildCVE-2026-29059CVE-2026-60137CVE-2026-63030+2 CVEs

Two new high severity WordPress vulnerabilities, patch immediately!

Help Net Security·Jul 21, 09:06 UTC · Jul 21, 2026Vulnerability in the wildCVE-2026-60137CVE-2026-630301

New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

The Hacker News·Jul 18, 05:23 UTC · Jul 18, 2026Exploit / PoC in the wildCVE-2026-63030CVE-2026-60137