---
id: 5588
title: "[CVE-2026-63030] Now Detecting: WP2Shell - Pre-Authentication RCE in WordPress Core"
cve: CVE-2026-63030
severity: critical
vendor: "WordPress"
product: "WordPress Core"
affected_versions: "WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1; fixed in 6.9.5 and 7.0.2"
source_domain: ethiack.com
source_url: "https://ethiack.com/info-hub/product/now-detecting-wp2shell"
published_at: "2026-07-17T00:00:00Z"
tags: ["rce", "zero-day", "rest-api", "sql-injection", "wordpress", "waf", "vulnerability", "ethiack", "cve-2026-63030"]
phying_url: "https://phying.com/item/5588"
lang: en
---

# [CVE-2026-63030] Now Detecting: WP2Shell - Pre-Authentication RCE in WordPress Core

## Summary

WP2Shell (CVE-2026-63030/CVE-2026-60137) is an unauthenticated WordPress Core RCE chaining a REST API batch-route confusion with SQL injection; Ethiack details patches, mitigations, and detection.

## Intelligence Metadata

- **Sources:** ethiack.com
- **CVE:** CVE-2026-63030
- **Vendor:** WordPress
- **Product:** WordPress Core
- **Affected versions:** WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1; fixed in 6.9.5 and 7.0.2
- **Published:** 2026-07-17T00:00:00Z
- **Original:** https://ethiack.com/info-hub/product/now-detecting-wp2shell
- **Phying News:** https://phying.com/item/5588