Exploit for CVE-2026-60137

wp2shell — WordPress Core Pre-Auth RCE CVE-2026-63030 Ba...

Exploit for CVE-2026-63030

wp2shell Pre-Authentication Remote Code Execution in WordPres...

Exploit for CVE-2026-63030

wp2shellscanner !smokehttps://github.com/zi3lak/wp2shell...

Exploit for CVE-2026-63030

wp2r00t - WordPress REST Batch Route-Confusion SQLi PoC A sel...

Exploit for CVE-2026-63030

wp2shell CVE-2026-63030 / CVE-2026-60137 PoC for an unaut...

Exploit for CVE-2026-63030

wp2shell-poc Proof-of-concept for an unauthenticated SQL inje...

CVE-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

CVE-2026-63030

Summary (CVE-2026-63030 & related CVE-2026-60137): WordPress core pre-6.9.5/7.0.2 is vulnerable to an unauthenticated remote code execution chain via the REST API batch endpoint. The root cause is a route-confusion bug in WP_REST_Server::serve_batch_request_v1() that desynchronizes the per-sub-re...