wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution
On July 17, 2026, Searchlight Cyber disclosed wp2shell , a pre-authentication remote code execution chain in WordPress Core ( CVE-2026-63030 , CVE-2026-60137 ). Proof-of-concept tools hit GitHub within hours. hashkitten published the chain after PoCs started circulating, including a write-up of how the bug was found .
Summary from Elastic Security Labs.
Explained
The technology and terms in this story. Learn more
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- ConceptProof of conceptA demonstration that a flaw can be exploited, usually published by researchers.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.