New wp2shell Word Press Core Flaw Lets Unauthenticated Attackers Run Code
Summary: An anonymous HTTP request can execute code on WordPress core through a chain of two bugs: CVE-2026-63030, a REST API batch-route confusion, and CVE-2026-60137, a SQL injection in WP_Query's author__not_in parameter. WordPress shipped 6.9.5 and 7.0.2 on Friday with forced auto-updates; the batch-route half exists only from 6.9, the injection goes back to 6.8, and a working proof-of-concept is now public on GitHub.
Why it matters: The RCE chain works on a default install with no plugins and no special settings, unlike the WP-SHELLSTORM campaign that reached more than 17,000 sites through a non-default configuration. WordPress has not said whether its forced push reaches sites that disabled auto-updates, so the exposed population is whatever is still running 6.9 or 7.0 unpatched.