CVE-2026-63030

Vendor

Fortinet, Elastic

Product

WordPress core

CVSS

7.5

EPSS

1.00 (p100)

CISA KEV

listed

Exposure class

Web platform, AI infrastructure, Database

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 72
   KEV NVD 17 Jul 2026

   WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code…

   WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.

   KEV CVSS 7.5 Fix available CVE-2026-63030
2. 46
   CISA advisory CISA 21 Jul 2026

   CISA Adds Four Known Exploited Vulnerabilities to Catalog

   CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability CVE-2026-0770 Langflow…

   Exploited CVE-2021-27137CVE-2026-0770CVE-2026-63030+1 more
3. 44
   Wiz Research Wiz 20 Jul 2026

   Exploitation in the Wild of wp2shell

   Wiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core (CVE-2026-63030 & CVE-2026-60137). Attackers are deploying persistent webshells on vulnerable servers.…

   Exploited CVE-2026-63030CVE-2026-60137
4. 31
   Research Insikt Group 19d ago

   September 2026 CVE Landscape

   In September 2026, Insikt Group® identified 94 high-impact vulnerabilities that should be prioritized for remediation, 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month.

   EPSS 1.00 CVE-2026-88771CVE-2026-88772CVE-2026-35273+57 more
5. 25
   Outbreak alert FortiGuard 31 Jul 2026

   WP2Shell RCE

   FortiGuard Labs continues to detect exploitation attempts targeting the WP2Shell attack chain (CVE-2026-63030 and CVE-2026-60137), a critical unauthenticated remote code execution (RCE) vulnerability affecting WordPress Core.…

   CVE-2026-63030CVE-2026-60137 Fortinet
6. 21
   Research Elastic Security Labs 23 Jul 2026

   wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution

   We ran the wp2shell WordPress RCE chain end-to-end with Elastic Defend. Detection rule walkthrough, IOCs, and hunt guidance.

   CVE-2026-63030CVE-2026-60137 Elastic
7. 16
   Research Insikt Group 8 Sep 2026

   August 2026 CVE Landscape

   In August 2026, Insikt Group® identified 73 high-impact vulnerabilities that should be prioritized for remediation, 43 of which had a Very Critical Recorded Future Risk Score. This represents a 14% decrease from last month.

   CVE-2025-62593CVE-2026-72898CVE-2026-9198+57 more
8. 16
   Research Insikt Group 7 Aug 2026

   July 2026 CVE Landscape

   In July 2026, Insikt Group® identified 85 high-impact vulnerabilities that should be prioritized for remediation, 36 of which had a Very Critical Recorded Future Risk Score. This represents a 44% increase from last month.

   CVE-2025-3248CVE-2008-4128CVE-2017-17215+57 more
9. 9
   ISC diary SANS ISC 20 Jul 2026

   WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)

   Last week, Searchlight Cyber released details about a vulnerability they are calling "wp2shell". The vulnerability was initially announced without a CVE number. But now has been assigned CVE-2026-63030. Many WordPress plugin…

   CVE-2026-63030