PT-2026-61650

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course...

WordPress 5.6+ SkelerSecurity Core Security Plugin REST Batch API Mitigation

This WordPress plugin provides a temporary mitigation for the REST Batch API vulnerability chain commonly referred to as "wp2shell." It requires authentication before requests to the /wp-json/batch/v1 and ?restroute=/batch/v1 endpoints are processed, preventing unauthenticated exploitation of the...

CVE-2026-39385: Authentication Bypass Using an Alternate Path or Channel

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course...

WordPress < 7.0.2 - REST API batch-route confusion and SQLi to RCE

Description WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

Exploit for CVE-2026-63030

wp2shell: WordPress Batch RCE A technical breakdown of CVE-20...

Exploit for CVE-2025-9951

CVE-2025-9951 FFmpeg JPEG 2000 exploitation research This rep...

Exploit for CVE-2026-63030

wp2shell — CVE-2026-63030 + CVE-2026-60137 One-day WordPres...

Exploit for CVE-2026-63030

CVE-2026-63030 — WordPress wp2shell Exploit Unauthenticated d...

Exploit for CVE-2026-60137

wp2shell-scanner by @bahartanirhttps://github.com/baha...

Exploit for CVE-2026-60137

wp2shell — WordPress Core Pre-Auth RCE CVE-2026-63030 Ba...

Ruoyi-Scan

Ruoyi-Scan — RuoYi-specific vulnerability scanning tool 2...

Exploit for CVE-2026-63030

wp2shell Pre-Authentication Remote Code Execution in WordPres...

Exploit for CVE-2026-63030

CVE-2026-63030 The WordPress REST API batch routing confusi...

Exploit for CVE-2026-60137

wp2shell-detect Blackbox, non-intrusive detector for wp...

Exploit for CVE-2026-63030

wp2shell-scan A scanner and proof-of-concept toolkit for CVE-202...

Exploit for CVE-2026-63030

WordPresShell Pre-auth RCE PoC for CVE-2026-63030 + CVE...

wp2shell_stock_chain

wp2shell stock-core chain Authorized-testing proof of concept...

Exploit for CVE-2026-63030

wp2shellscanner !smokehttps://github.com/zi3lak/wp2shell...

wp2shell

wp2shell WordPress REST batch route-confusion blind SQL injec...

Imperva Customers Protected Against “wp2shell” Pre-Authentication RCE in WordPress Core

TL;DR : A critical pre-authentication Remote Code Execution RCE vulnerability, dubbed "wp2shell" CVE-2026-63030, has been identified in WordPress Core. This vulnerability allows an unauthenticated attacker to execute arbitrary code on a vulnerable WordPress installation without any preconditions,...