Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-63030 & CVE-2026-60137: WordPress Core Pre-Authentication RCE Overview & Takeaways

netspi.com | vulnerability | #rce | #wordpress | #sqli | #cve-2026-63030 | #cve-2026-60137 | #in-the-wild | #patch-now

Summary

The wp2shell chain pairs REST API route confusion (CVE-2026-63030) with WP_Query SQL injection (CVE-2026-60137) for unauthenticated full RCE on WordPress Core, now actively exploited in the wild.
Published
Collected

original ↗

Related coverage

blog · wiz.io
Exploitation in the Wild of wp2shell
Wiz Research observed in-the-wild exploitation of wp2shell, a pre-auth RCE chain in WordPress Core (CVE-2026-63030, CVE-2026-60137), used to install persistent webshells and backdoor plugins.
blog · hacktron.ai
Could Modern Code Review Have Prevented wp2shell?
We recreated the WordPress pull requests behind CVE-2026-63030 and CVE-2026-60137 to test whether today's code reviewers and SAST tools would catch both vulnerabilities.
vulnerability · netspi.com
“StyleSmuggler” – Adobe Commerce, Adobe Commerce B2B, and Magento RCE (CVE-2026-75650): Overview and Takeaways
CVE-2026-75650 (CVSS 10.0) lets unauthenticated attackers inject PHP through Magento's email template engine for RCE, with in-the-wild exploitation and Rust backdoors confirmed before the hotfix.
vulnerability · netspi.com
CVE-2026-9082 Drupal Core PostgreSQL SQL Injection Overview and Takeaways
CVE-2026-9082 (CVSS 9.8) lets unauthenticated attackers run arbitrary SQL against Drupal Core on PostgreSQL via crafted JSON:API queries, risking database compromise or RCE; upgrade immediately.
vulnerability · netspi.com
CVE-2026-41940 cPanel & WHM Authentication Bypass Overview and Takeaways
CVE-2026-41940 (CVSS 9.8) is an authentication bypass in cPanel & WHM and WP Squared that injects values into server-side session files for root-level access, and was exploited before the patch.
vulnerability · netspi.com
CVE-2026-35616 & CVE-2026-21643 – Fortinet FortiClientEMS: Overview & Takeaways
Two actively exploited FortiClientEMS flaws: CVE-2026-35616, an unauthenticated API auth bypass to RCE in 7.4.5/7.4.6, and CVE-2026-21643, SQLi limited to 7.4.4 multi-tenant deployments.
back