Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication

Two WordPress Core vulnerabilities (CVE-2026-63030 and CVE-2026-60137) can be chained to achieve unauthenticated remote code execution, according to Seqrite researcher Amruta Wagh, GBHackers reports. Dubbed WP2Shell, the exploit chain reportedly emerged in July 2026 and combines REST API route confusion with SQL injection; WordPress 6.8.6, 6.9.5 and 7.0.2 are listed as fixed releases.