Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

WordPress core pre-auth RCE flaw

Vulnerability
First reported
Last updated
Happening score
H score 80
3 unique sources, 5 articles

Summary

Hide ▲

WordPress core's wp2shell chain combines CVE-2026-63030 and CVE-2026-60137 into unauthenticated remote code execution on vulnerable WordPress 6.9.x and 7.0.x installs. SearchLight Cyber said the exploit chain can be built with GPT5.6 Sol Ultra and starts with REST API batch route confusion and SQL injection before escalating to cache poisoning, authentication bypass, and backdoor plugin upload. Public proof-of-concept exploits are now on GitHub, and watchTowr says it is seeing in-the-wild exploitation after those releases. WordPress fixed the flaws in 6.9.5 and 7.0.2 and enabled forced automatic security updates for affected supported installations.

Related Happenings

SimpleHelp remote management software privileged technician account creation security flaw (CVE-2026-48558)

Vulnerability
H score46 First: 15.06.2026 23:06 Last: 15.06.2026 23:06 Sources 1

About this happening: CVE-2026-48558 is a critical authentication bypass in SimpleHelp RMM that affects OIDC authentication and can let an unauthenticated attacker forge a token and obt...

Open Happening

Storm-1175 high-tempo Medusa ransomware campaign

Campaign
H score59 First: 07.04.2026 13:02 Last: 07.04.2026 13:02 Sources 1

About this happening: Storm-1175 is running a high-tempo Medusa ransomware campaign that has repeatedly exploited n-day and zero-day flaws to gain initial access before patching closes the...

Open Happening

CISA adds four actively exploited flaws to KEV with FCEB deadlines

Public Sector Action
H score35 First: 13.02.2026 10:34 Last: 13.02.2026 10:34 Sources 1

About this happening: CISA added four vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation, putting FCEB agencies on a forced remed...

Open Happening

BeyondTrust Remote Support and Privileged Remote Access CVE-2026-1731 active exploitation wave

Exploitation Wave
H score76 First: 12.02.2026 23:34 Last: 12.02.2026 23:34 Sources 1

About this happening: CVE-2026-1731 in BeyondTrust Remote Support and Privileged Remote Access is now seeing first in-the-wild exploitation, putting exposed appliances at risk of remote...

Open Happening

SolarWinds Web Help Desk (WHD) multi-stage exploitation wave

Exploitation Wave
H score44 First: 09.02.2026 16:42 Last: 09.02.2026 16:42 Sources 1

About this happening: SolarWinds Web Help Desk (WHD) exploitation is a multi-stage intrusion wave affecting internet-exposed WHD instances. The foothold remains unconfirmed, but the wave is...

Latest development: 10.03.2026 08:17

CISA added CVE-2025-26399 in SolarWinds Web Help Desk to its Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation, said Microsoft and Huntress had reported threat actors using SolarWinds Web Help Desk flaws to obtain initial access, attributed the activity to the Warlock ransomware crew, and ordered Federal Civilian Executive Branch (FCEB) agencies to apply the fix by March 12, 2026.

Open Happening

Timeline

  1. 20.07.2026 17:00 1 articles · 11d ago

    Searchlight Cyber uses GPT5.6 Sol Ultra to build WP2Shell exploit chain

    Technical Analysis Update

    Searchlight Cyber’s Adam Kues used GPT5.6 Sol Ultra to develop WP2Shell, a multi-stage exploit chain against WordPress Core CVE-2026-63030 and CVE-2026-60137. The chain starts with REST API batch route confusion and SQL injection, then escalates through cache poisoning, WordPress customize changesets, authentication bypass, and backdoor plugin upload to reach pre-authentication remote code execution against WordPress 6.9.x and 7.0.x.

    Show sources
    Open in new tab
  2. 18.07.2026 20:22 3 articles · 13d ago

    watchTowr sees in-the-wild exploitation of WordPress Core wp2shell flaws

    Exploitation Observed

    Multiple public proof-of-concept exploits for WordPress Core wp2shell have been published on GitHub, and watchTowr said it is already seeing in-the-wild exploitation after those public exploits appeared. Cloudflare said it has deployed Web Application Firewall (WAF) protections for CVE-2026-60137 and CVE-2026-63030 across proxied plans, including free accounts.

    Show sources
    Open in new tab
  3. 18.07.2026 00:20 1 articles · 13d ago

    WordPress 6.9 ships with vulnerable core code

    Untyped Phase

    WordPress 6.9 shipped on December 2, 2025, and the flawed code only exists from 6.9 onward, establishing the affected core branch for the pre-auth remote code execution issue before the later 6.9.5 and 7.0.2 fixes.

    Show sources
    Open in new tab
  4. 18.07.2026 00:20 2 articles · 13d ago

    WordPress receives the wp2shell report and releases 6.9.5 and 7.0.2

    Initial Disclosure

    Adam Kues at Assetnote, Searchlight Cyber's attack surface management arm, reported the WordPress core flaw through HackerOne, and the wp2shell writeup described it as a pre-auth RCE that an anonymous user can exploit on a default install with no plugins. WordPress released 6.9.5 and 7.0.2 on July 17, 2026, enabled forced updates through its auto-update system, and described the bug as a REST API batch-route confusion and SQL injection issue leading to Remote Code Execution.

    Show sources
    Open in new tab