WordPress Remote Code Execution Vulnerabilities “wp2shell” (CVE-2026-63030 & CVE-2026-60137)

A Critical and medium-severity vulnerabilities, identified as CVE-2026-63030 and CVE-2026-60137, have been discovered in WordPress Core. When chained together, these vulnerabilities, collectively referred to as “wp2shell,” could allow an unauthenticated remote attacker to execute arbitrary code on an affected WordPress server. The attack can affect a default WordPress installation without requiring authentication or a vulnerable plugin. Public proof-of-concept exploit code has also been reported.

WordPress has released security updates and enabled forced automatic updates for affected installations due to the severity of these vulnerabilities. System owners are strongly recommended to verify their installed WordPress version and update to the latest version, as applicable, as soon as possible.

Vulnerability

• WordPress Remote Code Execution Vulnerability in Joomla JCE Editor (CVE-2026-63030)
• WordPress Remote Code Execution Vulnerability in Joomla JCE Editor (CVE-2026-60137)

Severity Level

• Critical: CVE-2026-63030
• Medium: CVE-2026-60137

Affected Versions

Remediation

• Update WordPress Core immediately:
  • Upgrade affected installations to WordPress 6.8.6, 6.9.5, or 7.0.2, as applicable.
• Verify automatic updates:
  • Although WordPress has enabled forced automatic updates for affected versions, system owners should verify the currently installed version instead of assuming the update has been completed successfully.
• Perform a post-update security review:
  • Review web server access logs, WordPress administrator accounts, recently installed plugins and themes, modified files, scheduled tasks, and unexpected database changes for signs of compromise.
• Apply temporary mitigations if immediate patching is not possible:
  • Temporarily block anonymous access to the WordPress REST API batch endpoints through the web server or Web Application Firewall.
• Back up the website before updating:
  • Create a verified backup of the WordPress files and database, then confirm that the website and its plugins continue to operate normally after the update.

Reference

• NVD – CVE-2026-63030
• NVD: CVE-2026-60137
• WordPress 7.0.2 Release
• Github: WordPress/wordpress-develop/Security/Advisories/GHSA-fpp7-x2x2-2mjf
• Github: WordPress/wordpress-develop/Security/Advisories/GHSA-ff9f-jf42-662q
• The Hacker News: New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

Published on: 20 July 2026