VulnerabilityBleeping Computer
9.8 — CRITICAL
WordPress Core "wp2shell" RCE flaws get public exploits, patch now
Public exploits have been released for the critical "wp2shell" remote code execution vulnerabilities affecting WordPress Core, making it imperative that administrators patch their sites immediately. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-63030 and CVE-2026-60137, has been discovered in WordPress Core, affecting versions 6.9.x and 7.0.x, with public exploits released, posing a significant risk to over 500 million websites.
⚙️Technical Details
Affected Systems
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2
Attack Vectors
NETWORK
💥Impact Assessment
Severity: CRITICAL
Who Is at Risk
Over 500 million websites using WordPress versions 6.9.x and 7.0.x
🛡️Recommended Actions
1Update to WordPress 7.0.2 or 6.9.5 immediately
2Install a plugin that blocks anonymous access to the REST API entirely
3Block wp-json/batch/v1 and ?rest_route=/batch/v1 at a WAF level
📦Affected Products
WordPress
🔐NVD Verified DataVERIFIED
CVE-2026-63030 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-436
CVE-2026-60137 ↗CVSS 5.9 — MEDIUM
Attack Vector
NETWORK
Complexity
HIGH
Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NWeaknesses
CWE-89
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.