WordPress Exploitation Underway (CVE-2026-63030) - SANS ISC
Reported exploitedWordPress CoreOur summary
A critical SQL injection vulnerability in WordPress Core, tracked as CVE-2026-63030, is currently being actively exploited. Dubbed 'wp2shell' by researchers, this flaw allows unauthenticated attackers to achieve remote code execution through the REST API. Attackers are already probing systems using crafted requests that attempt to inject malicious payloads into database queries. If you're running WordPress, check your exposure at https://wp2shell.com and assume compromise if vulnerable. Immediate patching is strongly recommended.
Below is the opening; the full story is at SANS Internet Storm Center.
From SANS Internet Storm Center
Last week, Searchlight Cyber released details about a vulnerability they are calling "wp2shell". The vulnerability was initially announced without a CVE number. But now has been assigned CVE-2026-63030. Many WordPress plugin vulnerabilities are never assigned CVE numbers. But wp2shell is different. It is a SQL injection vulnerability in WordPress Core, not a plugin, and can lead to unauthenticated remote code execution. Shortly after being announced, the vulnerability started to be exploited.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.