[CVE-2026-63030] Unauthenticated RCE in WordPress core (wp2shell), via SQL injection

CVE

CVE-2026-63030

Vendor

WordPress

Product

WordPress Core

Affected versions

WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1; fixed in 6.9.5 and 7.0.2

Published

2026-07-17 00:00

Collected

2026-07-21 06:57

---
id: 4608
title: "[CVE-2026-63030] Unauthenticated RCE in WordPress core (wp2shell), via SQL injection"
cve: CVE-2026-63030
severity: critical
vendor: "WordPress"
product: "WordPress Core"
affected_versions: "WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1; fixed in 6.9.5 and 7.0.2"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell"
published_at: "2026-07-17 00:00"
tags: ["rce", "featured", "vulnerability-research", "rest-api", "sql-injection", "wordpress", "vulnerability", "cve", "wp2shell"]
phying_url: "https://phying.com/item/4608"
lang: en
---

# [CVE-2026-63030] Unauthenticated RCE in WordPress core (wp2shell), via SQL injection

## Summary

WP2Shell chains CVE-2026-63030 in WordPress REST batch routing with the CVE-2026-60137 SQL-injection primitive to achieve pre-authentication remote code execution on stock WordPress installations. Versions 6.9.5 and 7.0.2 contain the fixes.

## Why it matters

WP2Shell chains a WordPress core REST routing flaw with SQL injection into pre-authentication RCE on stock installations. Affected sites should move immediately to 6.9.5 or 7.0.2.

## Intelligence Metadata

- **Sources:** aikido.dev
- **CVE:** CVE-2026-63030
- **Vendor:** WordPress
- **Product:** WordPress Core
- **Affected versions:** WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1; fixed in 6.9.5 and 7.0.2
- **Published:** 2026-07-17 00:00
- **Original:** https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell
- **Phying News:** https://phying.com/item/4608