Research

WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)

Last week, Searchlight Cyber released details about a vulnerability they are calling "wp2shell". The vulnerability was initially announced without a CVE number. But now has been assigned CVE-2026-63030. Many WordPress plugin vulnerabilities are never assigned CVE numbers. But wp2shell is different. It is a SQL injection vulnerability in WordPress Core, not a plugin, and can lead to unauthenticated remote code execution. Shortly after being announced, the vulnerability started to be exploited.

Read at SANS Internet Storm Center

Product

WordPress core

Exposure class

Web platform

• SANS Internet Storm Center (isc.sans.edu)
• CVE-2026-63030 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 31
   Research Insikt Group 19d ago

   September 2026 CVE Landscape

   EPSS 1.00 CVE-2026-88771CVE-2026-88772CVE-2026-35273+57 more
2. 16
   Research Insikt Group 8 Sep 2026

   August 2026 CVE Landscape

   CVE-2025-62593CVE-2026-72898CVE-2026-9198+57 more
3. 16
   Research Insikt Group 7 Aug 2026

   July 2026 CVE Landscape

   CVE-2025-3248CVE-2008-4128CVE-2017-17215+57 more
4. 25
   Outbreak alert FortiGuard 31 Jul 2026

   WP2Shell RCE

   CVE-2026-63030CVE-2026-60137 Fortinet
5. 21
   Research Elastic Security Labs 23 Jul 2026

   wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution

   CVE-2026-63030CVE-2026-60137 Elastic
6. 46
   CISA advisory CISA 21 Jul 2026

   CISA Adds Four Known Exploited Vulnerabilities to Catalog

   Exploited CVE-2021-27137CVE-2026-0770CVE-2026-63030+1 more
7. 44
   Wiz Research Wiz 20 Jul 2026

   Exploitation in the Wild of wp2shell

   Exploited CVE-2026-63030CVE-2026-60137
8. 72
   KEV NVD 17 Jul 2026

   WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code…

   KEV CVSS 7.5 Fix available CVE-2026-63030