WordPress patches critical wp2shell RCE chain in core

WordPress released 7.0.2 to fix two core vulnerabilities that can be chained into unauthenticated remote code execution, including CVE-2026-63030 and CVE-2026-60137. The flaws affect default WordPress installations without plugins, with the RCE path impacting 6.9.0 through 6.9.4, 7.0.0 through 7.0.1, and 7.1 beta, while the SQL injection issue also affects the 6.8 branch. WordPress issued backported fixes in 6.9.5, 6.8.6, and 7.1 Beta 2, enabled forced auto-updates for affected sites, and said the attack chain abuses the REST API batch endpoint to trigger route confusion, bypass request handling restrictions, and reach SQL injection that can lead to full site compromise.

Security vendors moved quickly to contain exposure as public technical details began to emerge. Cloudflare deployed WAF protections for both CVEs for all customers and Wordfence added firewall coverage for premium users, but both stressed that filtering is only a temporary mitigation and that patching is the primary remediation. Researchers attributed the discovery to Adam Kues of Searchlight Cyber's Assetnote team, and while early reporting said no in-the-wild exploitation had been confirmed, a public GitHub proof of concept later demonstrated unauthenticated access to the vulnerable batch endpoint and blind SQL injection against affected versions, increasing the likelihood of rapid attacker weaponization.