CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core
PatchWordPress CoreOur summary
A critical remote code execution flaw, CVE-2026-63030, has been patched in WordPress Core following a GitHub Security Advisory issued on July 17, 2026. The vulnerability allowed unauthenticated attackers to execute arbitrary code via the REST API batch endpoint, potentially leading to full site compromise. It affected versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Fixes are now available in 6.9.5, 7.0.2, and 7.1 Beta 2. Although no active exploitation has been reported yet, the lack of authentication requirements and widespread use of WordPress make this a high-risk issue. Immediate patching is strongly advised.
Below is the opening; the full story is at Rapid7 Blog.
From Rapid7 Blog
Overview
On July 17, 2026, a GitHub Security Advisory was published for CVE-2026-63030">CVE-2026-63030, a critical unauthenticated remote code execution vulnerability affecting WordPress Core. While the official GitHub security advisory classifies the severity as Critical, the vulnerability has currently been assigned a CVSS score of 7.5. WordPress is one of the most widely deployed content management systems, making vulnerabilities in its core software potentially significant for organizations operating public-facing websites. The vulnerability reportedly allows an unauthenticated attacker to execute code via the WordPress REST API batch endpoint, potentially resulting in complete compromise of the website and its underlying data. No valid account or user interaction is required.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.