Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Could Modern Code Review Have Prevented wp2shell?

hacktron.ai | blog | #code-review | #wordpress | #sast | #vulnerability-analysis | #cve-2026-63030 | #cve-2026-60137

Summary

We recreated the WordPress pull requests behind CVE-2026-63030 and CVE-2026-60137 to test whether today's code reviewers and SAST tools would catch both vulnerabilities.
Published
Collected

original ↗

Related coverage

blog · wiz.io
Exploitation in the Wild of wp2shell
Wiz Research observed in-the-wild exploitation of wp2shell, a pre-auth RCE chain in WordPress Core (CVE-2026-63030, CVE-2026-60137), used to install persistent webshells and backdoor plugins.
vulnerability · netspi.com
CVE-2026-63030 & CVE-2026-60137: WordPress Core Pre-Authentication RCE Overview & Takeaways
The wp2shell chain pairs REST API route confusion (CVE-2026-63030) with WP_Query SQL injection (CVE-2026-60137) for unauthenticated full RCE on WordPress Core, now actively exploited in the wild.
blog · about.gitlab.com
When to use SAST versus an LLM security scanner
AI-based review and SAST catch different classes of bugs and both have benefits. Here's how to decide which one runs where, and when your team needs both.
Critical · vulnerability · ethiack.com
Now Detecting: WP2Shell - Pre-Authentication RCE in WordPress Core
WP2Shell (CVE-2026-63030/CVE-2026-60137) is an unauthenticated WordPress Core RCE chaining a REST API batch-route confusion with SQL injection; Ethiack details patches, mitigations, and detection.
blog · hacktron.ai
Hacktron Review for Open Source
We are opening up Hacktron Review for Open Source, giving qualifying maintainers free PR security reviews with inline findings, auto-resolution, and project-specific learning.
blog · hacktron.ai
Introducing Hacktron Review
Hacktron Review is an AI security reviewer for pull requests that understands codebase context, reduces false positives, and catches exploitable vulnerabilities before they are merged.
back