Skip to content
brandefense.io
Request A Demo
Trending Vulnerabilities

Why it is trending

CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injec

Known-bad
  • CVSS 7.5
  • CIRCL KEV
  • CISA KEV
  • CISA SSVC: active
  • ENISA KEV
  • VulnCheck KEV
  • Metasploit
  • +1
Buzz
27discussion, 0-100
Danger
72exploitability, 0-100
Mentions
121since 17 Jul 2026
EPSS
11%exploit probability
Mentions Per Day · UTCpeak 4
29 days agoToday
Where The Talk Is · by platform121 total
  • GitHub50 mentions · 50 voices · 50 PoC
  • X40 mentions · 21 voices
  • Reddit1 mentions · 1 voices
  • Dark web30 mentions · count only

    Out of 121 mentions in total. We show how many, never what was said or where.

Newest Public Posts · plain text, newest first

X

  • CVE-2026-63030: WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.

    @lyrie_ai16 h agolikes 0views 27replies 1Open

  • Why this matters WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default…

    @lyrie_ai16 h agolikes 0views 19replies 1Open

  • CVE-2026-60137: WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default…

    @lyrie_ai16 h agolikes 0views 24replies 1Open

  • Seqrite reports WP2Shell enables pre-authentication RCE on vulnerable WordPress versions by chaining CVE-2026-63030 and CVE-2026-60137, stressing urgent patching and restricted REST API exposure. https://t.co/cl3UYQG1nw

    @Cyber_O51NT8 d agolikes 2views 261replies 1Open

  • 🔴 WordPress, Remote Code Execution, #CVE-2026-63030 (critical) -DC-Oct2026-3236 https://t.co/EzsMdMtKwh

    @dailycve8 d agolikes 0views 3replies 0Open

  • 京都教育大学が10月13日、6つのWebサイトがWordPressの脆弱性を突かれて改ざんされていたと公表しました。7月22日に気づいて公開を止め、9月4日までに復元と脆弱性の対応を終えて公開を再開しています。 使われたのは「wp2shell」と呼ばれる、WordPress本体の2つの脆弱性（CVE-2026-60137、CVE-2026-63030）を組み合わせる手口です。攻撃者は侵入用のPHPファイルを置き、そこからサイト内のファイルを書き換えていました。ほかのサーバーへの広がりと情報の漏えいは確認されていないとしています。 wp2shellは7月17日にSearchlight Cybe…

    @tyamadadd10 d agolikes 0views 106replies 1Open

  • NØX Echo Lineage Signal: CVE-2026-63030 Entity: Core Lineage: Public vulnerability → Public exploit/PoC → Observed exploitation Relationship: - Core → CVE-2026-63030 → Evidence → Operational Risk Current State: DISCLOSED, POC_AVAILABLE, ACTIVE_EXPLOITATION Watch:

    @_Why_Noot11 d agolikes 0views 43replies 1Open

  • NØØT Security Alerts Classification: Critical CVE: CVE-2026-63030 Product: WordPress / Core Summary: VulnCheck reports real-world exploitation activity affecting WordPress / Core. Evidence: Public PoC/exploit available; Active exploitation reported; Severe impact class; Live exploitation observed b…

    @Python_s_11 d agolikes 0views 68replies 0Open

  • #NØØT_Security_Alerts 🚨 #ALERT — CYBERXERO AI-AUGMENTED ATTACK CAMPAIGN COMPROMISES WORDPRESS SITES AND STEALS UKRAINIAN CIVILIAN DATA October 6, 2026 DISCLOSED BY: SOCRadar Threat Research Unit CAMPAIGN: CyberXero — AI-Augmented Initial Access Broker PRODUCT: WordPress, e-commerce platforms, and e…

    @Python_s_12 d agolikes 0views 89replies 0Open

  • Russian-speaking IAB "CyberXero" weaponizes Claude Code and 51 AI agents to breach Ukrainian 🇺🇦 critical infrastructure, exfiltrating 628,000+ records while a second actor industrializes fraud at scale. Key findings: - CyberXero runs two parallel pipelines: an automated global campaign exploiting W…

    @DFIR_Radar12 d agolikes 3views 406replies 1Open

GitHub

  • Tersurrr/Orga-Tersur-Daniel-CVE-2026-63030: CVE-2026-63030 — WordPress REST API Batch-Route Confusion

    Tersurrr/Orga-Tersur-Daniel-CVE-2026-630302 d agostars 0PoCOpen

  • 4B3R4M4-607D/CVE-2026-63030-POC: CVE-2026-63030 / wp2shell

    4B3R4M4-607D/CVE-2026-63030-POC2 d agostars 2PoCOpen

  • Githu836/PoC-for-CVE-2026-63030:

    Githu836/PoC-for-CVE-2026-630303 d agostars 0PoCOpen

  • K52-ai/CVE-2026-63030:

    K52-ai/CVE-2026-630304 d agostars 0PoCOpen

  • GitHub cross-source: gichirimaku/wp2shell-PoC: CVE-2026-63030 + CVE-2026-60137 exploit RCE chain.

    gichirimaku/wp2shell-PoC8 d agostars 564PoCOpen

  • 0xCyp1337/CVE-2026-63030-CVE-2026-60137-WP2SHELL:

    0xCyp1337/CVE-2026-63030-CVE-2026-60137-WP2SHELL11 d agostars 0PoCOpen

  • SentinelXofficial/sxwp2shell: WordPress wp2shell pre-auth RCE exploit kit (CVE-2026-63030 + CVE-2026-60137)

    SentinelXofficial/sxwp2shell15 d agostars 1PoCOpen

  • GitHub cross-source: manpisetsu/wp2shell: CVE-2026-63030 + CVE-2026-60137 exploit RCE chain

    manpisetsu/wp2shell16 d agostars 179PoCOpen

  • hitechcloud-vietnam/wp2shell-PoC: CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept

    hitechcloud-vietnam/wp2shell-PoC20 d agostars 0PoCOpen

  • MRdark-ops/WP2Shell--CVE-2026-63030-CVE-2026-60137-: Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exp…

    MRdark-ops/WP2Shell--CVE-2026-63030-CVE-2026-60137-24 d agostars 0PoCOpen

Reddit

  • wp2shell (CVE-2026-63030): Pre-Auth RCE Chain in WordPress Core - Analysis and Open-Source Scanner — submitted by /u/mazen160 [link] [comments]

    r/netsec97 d agoOpen
Public PoC Repositories · third-party code10 links

Links are collected from public posts and are not reviewed by Brandefense. Exploit code can be unsafe or malicious: only study it in an isolated lab, and never run it against systems you do not own.

Get a morning brief and an alert the moment a critical vulnerability like this one starts trending.

Subscribe