WordPress Core unauthenticated RCE (wp2shell)
A critical unauthenticated remote code execution flaw in WordPress Core (CVE-2026-63030). GitHub Security Advisory issued July 17, 2026; public PoC circulating.
- Vendor
- WordPress
- Product
- WordPress Core (6.9 and 7.0 branches per The Hacker News)
- CVSS
- 9.8
- EPSS (exploit probability)
- 10.6%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-63030 being exploited?
Yes. CISA added CVE-2026-63030 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in ENISA's EU Vulnerability Database (EUVD) exploited list.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 10.6% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ LISTED ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-63030 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-63030 — tracked publicly under the researcher tag wp2shell — is a critical unauthenticated remote code execution vulnerability in WordPress Core. A GitHub Security Advisory was published on July 17, 2026, and Rapid7’s Emergent Threat Response post went up the same day. The Hacker News reports a working public proof-of-concept is circulating and that a single anonymous HTTP request is sufficient to trigger code execution against a bare install with no plugins.
Scoring note
There is a public split on scoring. NVD lists CVE-2026-63030 at CVSS 9.8. The GitHub Security Advisory, per Rapid7’s write-up, classifies the flaw as Critical but assigns a CVSS of 7.5. Both source severities are Critical; the numeric split is unresolved as of this filing. Use the vendor advisory as authoritative for your risk register and cite the split explicitly if you’re briefing up.
Affected
Per The Hacker News, the WordPress 6.9 and 7.0 branches are in range. Because the flaw is in core, a WordPress install with zero third-party plugins is exploitable — the plugin ecosystem is not required for the primitive. Refer to the wordpress.org security page for the authoritative patched-version list before you plan the update.
What to do
Update WordPress Core to the patched release. If you cannot patch immediately, take the affected instance off the public internet. A public PoC plus an unauthenticated single-request trigger against a widely deployed CMS is a compromise-scale event on the timescale of hours, not weeks — treat any public-facing WordPress site that has not been updated since July 17 as compromise-adjacent until proven otherwise. CISA added CVE-2026-63030 (and its SQLi companion CVE-2026-60137) to KEV on July 21, 2026; see the KEV coverage for the BOD 26-04 timing implications.
Other WordPress Core CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-87902 WordPress core get_page_template path traversal enables unauthenticated RCEwrite-up | [ HIGH ] | 8.1 | 40.0% | |
| CVE-2026-60137 WordPress WP_Query author__not_in SQL injection (wp2shell companion)write-up | [ MEDIUM ] | 5.9 | 5.3% |
