WP2Shell: CVE-2026-63030 and CVE-2026-60137 chained for unauthenticated RCE on default WordPress, exploitation observed
Researchers describe WP2Shell, a chain of two WordPress core flaws, CVE-2026-63030 and CVE-2026-60137, that lets unauthenticated attackers progress from public REST API endpoints to remote code execution. It affects default installations with no third-party plugin required. Public exploit code exists and exploitation attempts have been ob…