Critical WordPress Core Vulnerability (wp2shell) Allows Unauthenticated Code Execution

A critical vulnerability, dubbed 'wp2shell' (CVE-2026-63030 and CVE-2026-60137), has been disclosed in WordPress core, enabling unauthenticated attackers to execute arbitrary code. WordPress has released patches in versions 6.9.5 and 7.0.2 to address these flaws, which affect default installations.

Context

WordPress is one of the most widely used content management systems globally, powering a substantial portion of the internet. The disclosed vulnerabilities, identified as CVE-2026-63030 and CVE-2026-60137, affect default installations of WordPress. The risk of exploitation underscores the importance of maintaining updated software.

Why it matters

The wp2shell vulnerability poses a significant risk to WordPress users, as it allows unauthenticated attackers to execute arbitrary code on affected sites. This could lead to data breaches, website defacement, or further exploitation of the server. Prompt updates are crucial to protect millions of websites powered by WordPress.

Implications

If left unaddressed, this vulnerability could lead to widespread exploitation, affecting website owners, users, and potentially impacting businesses relying on WordPress for their online presence. The situation may prompt increased scrutiny of WordPress security practices and lead to a push for more robust security measures in future updates.

What to watch

Users of WordPress are advised to update to versions 6.9.5 or 7.0.2 immediately to mitigate the risk. Monitoring for any reports of exploitation attempts or breaches related to this vulnerability will be important in the coming weeks. Security experts may provide additional guidance on best practices for safeguarding WordPress sites.