PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-63030] Now Detecting: WP2Shell - Pre-Authentication RCE in WordPress Core

ethiack.com | vulnerability | Critical | CVE-2026-63030 | #rce | #zero-day | #rest-api | #sql-injection | #wordpress | #waf | #vulnerability | #ethiack | #cve-2026-63030
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

WP2Shell (CVE-2026-63030/CVE-2026-60137) is an unauthenticated WordPress Core RCE chaining a REST API batch-route confusion with SQL injection; Ethiack details patches, mitigations, and detection.
CVE
CVE-2026-63030
Vendor
WordPress
Product
WordPress Core
Affected versions
WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1; fixed in 6.9.5 and 7.0.2
Published
Collected

Related coverage

Critical · vulnerability · aikido.dev
Unauthenticated RCE in WordPress core (wp2shell), via SQL injection
WP2Shell chains a WordPress core REST routing flaw with SQL injection into pre-authentication RCE on stock installations. Affected sites should move immediately to 6.9.5 or 7.0.2.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
Critical · vulnerability · github.com
CVE-2026-111497: Unauthenticated WordPress RCE Exploit Chain PoC via Brotli Decoder Flaw
Demonstrates a reliable, real-world weaponization of the Brotli decoder memory corruption flaw in web application environments without requiring information leaks or debugging instrumentation. Highlights the critical risk of untrusted compressed streams in server-side HTTP clients.
vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
vulnerability · volexity.com
[CVE-2026-85046] Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP
# Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP October 16, 2026 Volexity Volcano Team Last month, Volexity published two blog posts in its _Mind the (Patch)...
Back