⚡ UPDATE: #wp2shell now has two CVEs, and a working proof-of-concept is public.

> CVE-2026-63030 breaks REST batch routing
> CVE-2026-60137 injects SQL

Chained, they give an anonymous attacker code execution on affected WordPress sites.

How the exploit path works: https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html

🛑 ALERT - WordPress sites are under active attack.

Attackers are exploiting the #wp2shell chain to gain unauthenticated RCE on vulnerable stock installations, with no plugins required. Public exploit code is now fueling mass scanning and web shell deployments.

Read what defenders should check: https://thehackernews.com/2026/07/wordpress-wp2shell-exploitation-grows.html