🛡️ CVE-2026-63030

The items that name it 6

• gichirimaku/wp2shell-PoC
  repo2026-10-15

  Route confusion in the WordPress core batch REST endpoint (/wp-json/batch/v1). A malformed sub-request path desynchronizes two internal arrays, causing later requests to be dispatched under the wrong handler and bypass schema validation and permission checks.

• Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms
  writeup2026-09-18It is written here as CVE-2026-63030 (wp2shell exploitation chain).

  wp2shell exploitation chain

• Opening the Black Box: Agentless Threat Detection for Virtual Appliances
  writeup2026-07-22

  Part of 'wp2shell' critical pre-auth RCE vulnerability chain impacting WordPress Core, identified by Wiz Research; attackers deploying persistent webshells

• Agentless Threat Detection: Illuminating Cloud Blind Spots
  article2026-07-21
• wp2shell CVE-2026-63030: The WordPress RCE Putting 500+ Million Sites at Risk
  article2026-07-21It is written here as CVE-2026-63030 (REST API batch-route confusion in /wp-json/batch/v1; introduced in WordPress 6.9; rated High, CVSS 7.5 on its own).

  REST API batch-route confusion in /wp-json/batch/v1; introduced in WordPress 6.9; rated High, CVSS 7.5 on its own

• Exploitation in the Wild of wp2shell
  writeup2026-07-20