wp2shell

CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress core REST API batch route confusion CVE-2026-63030 chained with a WPQuery authornotin SQL injection CVE-2026-60137 → pre-auth remote code execution against a default WordPress install. Discovered by Adam Kues Assetnote...