CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core

2026-07-18T07:23:42Z•236f835d5f8ec85a62dbd857d053bca3a3939778aba450f7cd1ef22b8f32b62f

RCEauthentication-bypassgithub-security-advisorynvdpatch-availableremote-code-executionrest-apiunauthenticatedweb-applicationwordpresswp2shell

Open source link →

What happened

CVE-2026-63030 (“wp2shell”) is an unauthenticated remote code execution vulnerability in WordPress Core that allows an attacker to execute arbitrary code via the REST API batch endpoint. Affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1; no valid account or user interaction is required. The GitHub advisory classifies the issue as Critical, though an initial CVSS score of 7.5 has been reported; WordPress released updates to address the flaw.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: rapid7_blog
Record identifier: 236f835d5f8ec85a62dbd857d053bca3a3939778aba450f7cd1ef22b8f32b62f
Enrichment time: 2026-07-18T07:23:42Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records