CVE-2026-63030Vulnerability
WordPress Core Interpretation Conflict Vulnerability
Reported by 10 independent sources · first reported by Infosecurity Magazine · last reported
Last reported yesterday
Fix due 24 Jul 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 95% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
15 reports, newest first · the exact sentence from each-
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions“CVE-2026-63030 (WordPress wp2shell) (Developed)”
-
WP2Shell Exploit Chain: Anatomy of a Sophisticated WordPress Attack“The exploitation chain leverages two WordPress Core vulnerabilities CVE-2026-63030 and CVE-2026-60137 which can be chained to transition from an unauthenticated attack condition to arbitrary code execution on affected WordPress 6.9.x and 7.0.x installations.”
-
The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws“CVE-2026-63030 — WordPress REST API”
-
September 2026 CVE Landscape“CVE-2026-63030”
-
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records“The global campaign specifically focuses on known security flaws like wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815, an SQL injection vulnerability impacting the Support Board WordPress plugin, to seize control of WordPress sites.”
-
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer“…restingly, Overload RAT has been observed in two other campaigns since July 2026: one involving the exploitation of WordPress flaws (CVE-2026-63030 and CVE-2026-60137, aka wp2shell) and a macOS campaign in which a fake Zoom installer is used to deploy the RAT.”
-
CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure“CVE-2026-63030”
-
Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine’s Defense Industry“…every internet-facing appliance matching the 19+ CVEs in this campaign’s arsenal, prioritizing Sophos XG (CVE-2022-1040), WordPress (CVE-2026-63030), FortiOS (CVE-2024-55591), F5 BIG-IP (CVE-2023-46747), SAP NetWeaver (CVE-2025-31324), and Roundcube (CVE-2025-49113 / CVE-2025-252…”
-
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation“CVE-2026-63030,”
-
Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms“The interface groups targets under five named exploitation chains: react2shell (CVE-2025-55182), wp2shell (CVE-2026-63030 and CVE-2026-60137), xss2shell (CVE-2026-64638), joomla2shell (CVE-2026-48907), and deep.”
-
August 2026 CVE Landscape“CVE-2026-63030”
-
Metasploit Wrap Up: Payloads and Exploits, and Scanners, Oh my!“…ption: Adds an auxiliary scanner module for the "wp2shell" WordPress core unauthenticated SQL injection: REST batch route confusion (CVE-2026-63030) chained with the WP_Query author__not_in string interpolation (CVE-2026-60137).”
-
July 2026 CVE Landscape“CVE-2026-63030”
-
wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution“On July 17, 2026, Searchlight Cyber disclosed wp2shell, a pre-authentication remote code execution chain in WordPress Core (CVE-2026-63030, CVE-2026-60137).”
-
Researchers Build WordPress Exploit Using OpenAI's GPT“The first vulnerability, tracked as CVE-2026-63030 is a critical REST API batch endpoint route confusion issue (CVSS rating: 9.8) affecting WordPress Core versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-60137, CVE-2025-49113, CVE-2026-60004, CVE-2022-0847, CVE-2026-39987, CVE-2021-29441, CVE-2026-9198, CVE-2026-33824, CVE-2026-15409, CVE-2025-55182, CVE-2025-3248, CVE-2021-4034, CVE-2026-16232, CVE-2026-20316, CVE-2026-34486, CVE-2026-48907, CVE-2021-3156, CVE-2026-0257, CVE-2026-3055, CVE-2026-12569
Thanks — we review every report.