WordPress Exploitation Underway (CVE-2026-63030) - SANS ISC
A critical SQL injection vulnerability in WordPress Core, tracked as CVE-2026-63030, is currently being actively exploited. Dubbed 'wp2shell' by researchers, this flaw allows unauthenticated attackers to achieve remote code execution through the REST API. Attackers are already probing systems using crafted requests that attempt to inject malicious payloads into database queries. If you're running WordPress, check your exposure at https://wp2shell.com and assume compromise if vulnerable. Immediate patching is strongly recommended.
Last week, Searchlight Cyber released details about a vulnerability they are calling "wp2shell". The vulnerability was initially announced without a CVE number. But now has been assigned CVE-2026-63030. Many WordPress plugin vulnerabilities are never assigned CVE numbers. But wp2shell is different. It is a SQL injection vulnerability in WordPress Core, not a plugin, and can lead to unauthenticated remote code execution. Shortly after being announced, the vulnerability started to be exploited.…