CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core
A critical remote code execution flaw, CVE-2026-63030, has been patched in WordPress Core following a GitHub Security Advisory issued on July 17, 2026. The vulnerability allowed unauthenticated attackers to execute arbitrary code via the REST API batch endpoint, potentially leading to full site compromise. It affected versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Fixes are now available in 6.9.5, 7.0.2, and 7.1 Beta 2. Although no active exploitation has been reported yet, the lack of authentication requirements and widespread use of WordPress make this a high-risk issue. Immediate patching is strongly advised.
Overview
On July 17, 2026, a GitHub Security Advisory was published for CVE-2026-63030">CVE-2026-63030, a critical unauthenticated remote code execution vulnerability affecting WordPress Core. While the official GitHub security advisory classifies the severity as Critical, the vulnerability has currently been assigned a CVSS score of 7.5. WordPress is one of the most widely deployed content management systems, making vulnerabilities in its core software potentially significant for organizations operating public-facing websites. The vulnerability reportedly allows an unauthenticated attacker to execute code via the WordPress REST API batch endpoint, potentially resulting in complete compromise of the website and its underlying data. No valid account or user interaction is required.…