wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0–6.9.4 / 7.0.0–7.0.1.
wordpress wordfence wordpress-core codeb0ss realcodeb0ss thecodeb0ss wp2shell cve-2026-63030 cve-2026-60137
-
Updated
Jul 18, 2026 - Python