CVE-2026-63030-Wp2Shell

CVE-2026-63030 wp2shell — WordPress Core Pre-Auth RCE REST API batch route confusion chained with CVE-2026-60137 SQL injection TL;DR — An unauthenticated attacker can chain a WordPress REST API batch-routing bug with a SQL injection in WPQuery to reach full remote code execution on a stock...

CVE-2026-63030

CVE-2026-63030 - PoC per la confusione delle route batch dell'API REST di WordPress Descrizione Exploit proof-of-concept per CVE-2026-63030, una vulnerabilità pre-autenticazione in WordPress versioni da 6.9.0 a 7.0.1. Combina: Confusione delle route batch dell'API REST discrepanza tra validazione...

wp2shell-vulnerability-scanner

WP2Shell Scanner A read-only, non-destructive security audit tool that scans WordPress installations for the wp2shell vulnerability chain. Panoramica WP2Shell Scanner è un'utilità bash che ricerca ricorsivamente un albero di directory per installazioni WordPress e verifica se ciascun sito esegue...

wordpress-batch-rce-lab

wp2shell: WordPress Batch RCE A technical breakdown of CVE-2026-63030, a logic bug in WordPress core's REST API batch endpoint that lets an anonymous request dispatch under a different request's route and permission check, chaining into CVE-2026-60137 SQL injection for unauthenticated remote code...

abdal-cve-2026-63030

English | فارسی 🛡️ Abdal CVE-2026-63030 PoC Exploits Abdal CVE-2026-63030 is a defensive WordPress exposure verifier for the REST API batch route confusion tracked as CVE-2026-63030. The issue can be chained with CVE-2026-60137 on affected WordPress releases and may lead to remote code execution...

Exploit for Interpretation Conflict in Wordpress

WP2Shell — CVE-2026-63030 + CVE-2026-60137 WordPress Core Pre-...

Exploit for CVE-2026-63030

CVE-2026-63030 The WordPress REST API batch routing confusi...

Imperva Customers Protected Against “wp2shell” Pre-Authentication RCE in WordPress Core

TL;DR : A critical pre-authentication Remote Code Execution RCE vulnerability, dubbed "wp2shell" CVE-2026-63030, has been identified in WordPress Core. This vulnerability allows an unauthenticated attacker to execute arbitrary code on a vulnerable WordPress installation without any preconditions,...