🧰 WordPress Core

The items that name it 11

• Fresh WordPress Vulnerability in Attackers’ Crosshairs
  article2026-10-30It is written here as WordPress Core (fixed in 7.1.4 and backported to branches through 4.7).

  fixed in 7.1.4 and backported to branches through 4.7

• gichirimaku/wp2shell-PoC
  repo2026-10-15

  Affected by the wp2shell vulnerability chain combining CVE-2026-63030 and CVE-2026-60137, enabling an unauthenticated path to full compromise.

• WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments
  advisory2026-09-22
• Critical Elementor Pro File Upload Flaw Enables Unauthenticated Remote Code Execution on WordPress Sites
  advisory2026-08-20

  Vulnerable to CVE-2026-65640; exploitation requires Imagick and Ghostscript in use on the server.

• [tl;dr sec] #341 - Hugging Face Incident Black Hat Talk, CSS Bomb in your Inbox, GitHub Supply Chain Security Improvements
  article2026-08-13It is written here as WordPress core (pre-authentication RCE chain wp2shell; page says it affects 40% of the internet).

  pre-authentication RCE chain wp2shell; page says it affects 40% of the internet

• SQL injection isn't dead
  article2026-07-22
• Opening the Black Box: Agentless Threat Detection for Virtual Appliances
  writeup2026-07-22

  Affected by 'wp2shell' critical pre-auth RCE vulnerability chain (CVE-2026-63030 & CVE-2026-60137), attackers deploying persistent webshells

• Agentless Threat Detection: Illuminating Cloud Blind Spots
  article2026-07-21

  Affected by wp2shell pre-auth RCE vulnerability chain (CVE-2026-63030 & CVE-2026-60137)

• Exploitation in the Wild of wp2shell
  writeup2026-07-20

  Vulnerable to the wp2shell pre-authentication RCE chain (CVE-2026-63030 & CVE-2026-60137) on default installations.

• Unauthenticated RCE in WordPress core (wp2shell), via SQL injection
  writeup2026-07-17

  vulnerable to unauthenticated RCE via SQL injection; fixed in 6.9.5

• Known Exploited Vulnerabilities Catalog | CISA
  other