{"id":65281,"date":"2026-07-18T12:00:36","date_gmt":"2026-07-18T19:00:36","guid":{"rendered":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/"},"modified":"2026-07-18T12:00:36","modified_gmt":"2026-07-18T19:00:36","slug":"wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per","status":"publish","type":"post","link":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/","title":{"rendered":"wp2shell (CVE-2026-63030): Unauthenticated Pre-Auth RCE in WordPress Core &#8211; Advisory + Nuclei Detection"},"content":{"rendered":"<p>On July 17, 2026, WordPress shipped an emergency round of releases &#8211; 7.0.2, 6.9.5, and 6.8.6 &#8211; to close <strong>wp2shell<\/strong>, tracked as <strong>CVE-2026-63030<\/strong>: a pre-authentication remote code execution chain in WordPress Core. Two words make this one matter: &ldquo;pre-authentication&rdquo; and &ldquo;Core.&rdquo; An anonymous attacker, with no account and no vulnerable plugin, can reach code execution on a default WordPress install. With WordPress powering a large share of the web, the exposed population is enormous, and WordPress.org took the unusual step of forcing automatic updates for affected versions.<\/p>\n<p>This advisory is three things at once. First, a plain-English explanation of what wp2shell is and who is affected. Second, a ready-to-run <strong>Nuclei detection template<\/strong> you can copy, paste, and scan with today. Third, a walkthrough of how to find every affected WordPress instance across an attack surface with <a href=\"\/wordpress\/sn1per-professional-2026\/\">Sn1per<\/a>. Credit where it is due: wp2shell was discovered by Adam Kues of Searchlight Cyber&rsquo;s Assetnote research team and reported responsibly through WordPress&rsquo;s HackerOne program. Their write-up is the authoritative technical source (<a href=\"https:\/\/slcyber.io\/research-center\/wp2shell-pre-authentication-rce-in-wordpress-core\/\" rel=\"nofollow\" target=\"_blank\">Searchlight Cyber advisory<\/a>).<\/p>\n<h2 id=\"at-a-glance\">wp2shell at a glance<\/h2>\n<ul>\n<li><strong>CVE:<\/strong> CVE-2026-63030 (REST batch-route confusion) chained with CVE-2026-60137 (WP_Query SQL injection).<\/li>\n<li><strong>Impact:<\/strong> unauthenticated, pre-auth remote code execution against a stock install with zero plugins.<\/li>\n<li><strong>Affected:<\/strong> WordPress Core 6.9.0 &#8211; 6.9.4 and 7.0.0 &#8211; 7.0.1.<\/li>\n<li><strong>Fixed:<\/strong> 7.0.2, 6.9.5, and 6.8.6, all released July 17, 2026.<\/li>\n<li><strong>Fix now:<\/strong> update Core. If you cannot, block <code>\/wp-json\/batch\/v1<\/code> and <code>\/?rest_route=\/batch\/v1<\/code> at your WAF.<\/li>\n<li><strong>Detect:<\/strong> use the Nuclei template below for spot checks, or Sn1per to sweep an entire attack surface.<\/li>\n<\/ul>\n<h2 id=\"what-is-wp2shell\">What is wp2shell (CVE-2026-63030)?<\/h2>\n<p>wp2shell is the nickname for a chain of two vulnerabilities that together turn an anonymous HTTP request into remote code execution. Neither half is catastrophic alone; combined, they are.<\/p>\n<p>The first link is <strong>CVE-2026-60137<\/strong>, a SQL injection in the <code>author__not_in<\/code> parameter of <code>WP_Query<\/code> &#8211; the core class behind almost every database query WordPress runs. It is classified as CWE-89 (SQL injection), tracked as GHSA-fpp7-x2x2-2mjf, and reaches back to WordPress 6.8, giving it the widest exposure of the two. On its own it is reachable only by an authenticated user, because a blocklist restricts the vulnerable parameter to logged-in callers.<\/p>\n<p>The second link is <strong>CVE-2026-63030<\/strong> itself, a REST API batch-route confusion (CWE-436, &ldquo;interpretation conflict&rdquo;) in the <code>\/wp-json\/batch\/v1<\/code> endpoint that has shipped with Core since version 5.6 in 2020. The flaw lets a crafted request dispatch under the wrong handler, effectively bypassing the permission checks that should stop an anonymous caller. That bypass is what unblocks the authenticated-only SQL injection: route CVE-2026-60137 through the confused batch endpoint on 6.9 and later, and the confined injection becomes reachable pre-auth and escalates to full remote code execution. That escalation is the &ldquo;shell&rdquo; in wp2shell.<\/p>\n<p>One nuance worth knowing for triage: the <strong>CVSS score for this chain is disputed across sources<\/strong>. The NVD entry carries both a 9.8 Critical CNA score and a separate 7.5 secondary (CISA-ADP) assessment; Wordfence and WPScan score it 9.8, while the GitHub Security Advisory lists 7.5. The published vector is <code>CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H<\/code>. Do not let a single number drive your response &#8211; the operational facts (pre-auth, remote, Core, no plugin required, patch available, public partial PoC) matter more than which score you trust.<\/p>\n<p>The detail that makes it a headline is the absence of preconditions. No login, no plugin, no unusual configuration &#8211; a default WordPress install with zero plugins is exploitable by an anonymous request. That is why WordPress forced auto-updates, and why every internet-facing instance needs to be checked rather than assumed patched.<\/p>\n<p>One factor can blunt the worst case: per analysis from Cloudflare and the WordPress security team, the full RCE path is reachable when a persistent object cache is <em>not<\/em> enabled &#8211; a common default, but many managed hosts run Redis or Memcached, which may shield the RCE tip of the chain (the standalone SQL injection still applies). This detail was intentionally held back from the first announcement so no one used it as an excuse to delay patching.<\/p>\n<p>A responsible-disclosure note on the exploit status: at the time of the fix there was no public proof-of-concept and no confirmed in-the-wild exploitation, and the researchers withheld the full exploit details to give defenders time to patch. That window is already closing. As of July 18, 2026, a public proof-of-concept demonstrates the SQL injection half (it can read the database, including administrator password hashes), the full RCE primitive has not yet been published, and early reports of in-the-wild activity have begun to surface. Because WordPress is open source, a complete exploit is widely expected to be reconstructed quickly from the patch diff, so treat the clock as running.<\/p>\n<h2 id=\"affected-versions\">Affected and fixed versions<\/h2>\n<p>The two flaws have slightly different reach, which the version math reflects. The batch-route confusion that enables RCE only exists from 6.9.0 onward. The SQL injection alone reaches back to 6.8. Here is the practical breakdown:<\/p>\n<table>\n<thead>\n<tr>\n<th>WordPress version<\/th>\n<th>Status<\/th>\n<th>Action<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Below 6.8.0<\/td>\n<td>Not affected by either issue<\/td>\n<td>None for wp2shell<\/td>\n<\/tr>\n<tr>\n<td>6.8.0 &#8211; 6.8.5<\/td>\n<td>SQL injection only (CVE-2026-60137); not the RCE chain<\/td>\n<td>Update to 6.8.6<\/td>\n<\/tr>\n<tr>\n<td>6.8.6<\/td>\n<td>Patched<\/td>\n<td>None<\/td>\n<\/tr>\n<tr>\n<td><strong>6.9.0 &#8211; 6.9.4<\/strong><\/td>\n<td><strong>Affected by wp2shell RCE<\/strong><\/td>\n<td>Update to 6.9.5 now<\/td>\n<\/tr>\n<tr>\n<td>6.9.5<\/td>\n<td>Patched<\/td>\n<td>None<\/td>\n<\/tr>\n<tr>\n<td><strong>7.0.0 &#8211; 7.0.1<\/strong><\/td>\n<td><strong>Affected by wp2shell RCE<\/strong><\/td>\n<td>Update to 7.0.2 now<\/td>\n<\/tr>\n<tr>\n<td>7.0.2<\/td>\n<td>Patched<\/td>\n<td>None<\/td>\n<\/tr>\n<tr>\n<td>7.1 beta line<\/td>\n<td>Carries the fix<\/td>\n<td>None<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The key takeaway: the RCE-affected versions are <strong>6.9.0 &#8211; 6.9.4<\/strong> and <strong>7.0.0 &#8211; 7.0.1<\/strong>. If <code>wp core version<\/code> returns anything in those ranges, treat the site as at-risk and patch immediately. If you are on 6.8.x you are still exposed to the standalone SQL injection and should move to 6.8.6, even though the full RCE chain does not apply to that branch.<\/p>\n<h2 id=\"how-it-works\">How the exploit chain works<\/h2>\n<p>WordPress 5.6 added <code>\/wp-json\/batch\/v1<\/code> so a client can bundle several REST calls into a single request. Server-side, the batch handler validates each sub-request, builds a list of matched routes alongside a parallel list of validation results, and then dispatches each matched route. The bug is an alignment problem: when a request contains a malformed or unusual path, the matched-routes array and the validation array fall out of sync. A sub-request can then be dispatched under a handler that was validated for a different route. That is the &ldquo;route confusion,&rdquo; and its practical consequence is that the permission and authentication checks that should apply to an anonymous caller are effectively bypassed, because the request is handled as though it had passed a different route&rsquo;s checks.<\/p>\n<p>With that authentication barrier gone, the request reaches an injectable code path: the <code>author__not_in<\/code> parameter flows into <code>WP_Query<\/code> and, ultimately, into a SQL statement without safe parameterization. The result is boolean- and time-based blind SQL injection, reachable pre-authentication &#8211; already enough to read arbitrary database contents, including the administrator password hashes in <code>wp_users<\/code>. Turning database read into code execution takes one more step: either using recovered credentials, or an additional pre-authentication database-to-file-write primitive. The researchers did not publish that final primitive, which is why there is no drop-in public exploit yet.<\/p>\n<p>We are deliberately <em>not<\/em> publishing a working exploit here. What follows is detection only &#8211; version fingerprinting that tells you whether a given WordPress instance sits in the affected range, so you can prioritize patching. That is the responsible half, and for defenders it is the useful half. It is the same approach we took in our earlier advisories, such as <a href=\"\/wordpress\/cve-2024-21733-apache-tomcat-http-request-smuggling\/\">CVE-2024-21733 (Apache Tomcat request smuggling)<\/a> and <a href=\"\/wordpress\/spring4shell-cve-2022-22965-detection-with-sn1per-professional\/\">Spring4Shell (CVE-2022-22965)<\/a>: explain the flaw, then ship a safe detection you can run at scale.<\/p>\n<h2 id=\"quick-checks\">Am I affected? Quick manual checks<\/h2>\n<p>On a host you control, the authoritative check is WP-CLI, run from the WordPress root:<\/p>\n<pre><code># Authoritative: ask WordPress directly, from the WordPress root\nwp core version\n# At-risk if it prints 6.9.0-6.9.4 or 7.0.0-7.0.1.\n# Fixed at 6.9.5 \/ 7.0.2 \/ 6.8.6.<\/code><\/pre>\n<p>From the outside, a stock install advertises its version in several public places. Any one of these is enough to fingerprint it:<\/p>\n<pre><code># Generator meta tag on the home page\ncurl -s https:\/\/example.com\/ | grep -i 'name=\"generator\"'\n\n# RSS feed generator\ncurl -s 'https:\/\/example.com\/?feed=rss2' | grep -i 'generator'\n\n# Core asset version on wp-includes scripts\ncurl -s https:\/\/example.com\/ | grep -oiE '\/wp-includes\/[^\"]*?ver=[0-9.]+' | head<\/code><\/pre>\n<p>One caveat that matters for accuracy: hardening plugins and some WAFs strip the generator tag, the feed generator, and asset version strings. On those sites external version detection returns nothing, which is neither a positive nor a negative &#8211; fall back to the authoritative <code>wp core version<\/code> on the host, or an authenticated dashboard check under <strong>Dashboard &rarr; Updates<\/strong>.<\/p>\n<h2 id=\"nuclei-template\">Nuclei detection template for wp2shell<\/h2>\n<p>To check one site or ten thousand, a version-based Nuclei template is the fastest path. The template below &#8211; the same one shipped in Sn1per&rsquo;s curated template set &#8211; passively fingerprints the WordPress core version from four independent public sources (the generator meta tag, the RSS feed generator, the OPML generator, and core <code>\/wp-includes\/<\/code> asset <code>?ver=<\/code> strings) and flags any install whose version falls inside the affected 6.9.0 &#8211; 6.9.4 or 7.0.0 &#8211; 7.0.1 ranges using Nuclei&rsquo;s <code>compare_versions<\/code> DSL. It sends no exploit traffic; it only reads version markers, so it is safe to run against production.<\/p>\n<pre><code>id: CVE-2026-63030\n\ninfo:\n  name: WordPress Core 6.9.0-6.9.4 \/ 7.0.0-7.0.1 - Unauthenticated RCE (wp2shell)\n  author: xer0dayz\n  severity: critical\n  description: |\n    WordPress Core is affected by \"wp2shell\" (CVE-2026-63030), a pre-authentication\n    remote code execution chain. A REST API batch-route confusion in \/wp-json\/batch\/v1\n    (CVE-2026-63030, CWE-436) escalates an unauthenticated SQL injection in the\n    WP_Query author__not_in parameter (CVE-2026-60137, CWE-89) into full remote code\n    execution against a default install with zero plugins. This template passively\n    fingerprints the running WordPress core version from public sources (generator\n    meta tag, RSS feed generator, OPML generator, and core \/wp-includes\/ asset\n    versions) and flags installs inside the affected ranges 6.9.0-6.9.4 and\n    7.0.0-7.0.1. Fixed in 7.0.2, 6.9.5, and 6.8.6 (released 2026-07-17).\n  remediation: |\n    Update WordPress Core to 7.0.2 (7.0 branch), 6.9.5 (6.9 branch), or 6.8.6 (6.8 branch).\n    If patching is not immediately possible, block anonymous access to BOTH\n    \/wp-json\/batch\/v1 and \/?rest_route=\/batch\/v1 at the WAF (a rule covering only the\n    path leaves the query-string route open). Verify with: wp core version.\n  reference:\n    - https:\/\/slcyber.io\/research-center\/wp2shell-pre-authentication-rce-in-wordpress-core\/\n    - https:\/\/wp2shell.com\/\n    - https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-63030\n  classification:\n    cvss-metrics: CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-63030\n    cwe-id: CWE-436\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: wordpress\n    product: wordpress\n    shodan-query: http.component:\"WordPress\"\n  tags: cve,cve2026,wordpress,wp,wp2shell,rce,sqli,unauth,route-confusion\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n      - \"{{BaseURL}}\/?feed=rss2\"\n      - \"{{BaseURL}}\/feed\/\"\n      - \"{{BaseURL}}\/wp-links-opml.php\"\n\n    stop-at-first-match: true\n    redirects: true\n    max-redirects: 2\n\n    matchers-condition: or\n    matchers:\n      - type: dsl\n        name: affected-6.9.0-through-6.9.4\n        dsl:\n          - \"compare_versions(version, '&gt;= 6.9.0', '&lt;= 6.9.4')\"\n\n      - type: dsl\n        name: affected-7.0.0-through-7.0.1\n        dsl:\n          - \"compare_versions(version, '&gt;= 7.0.0', '&lt;= 7.0.1')\"\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - '(?:content=\"WordPress |wordpress.org\/?v=|generator=\"WordPress\/|\/wp-includes\/[^\"s&gt;]*?ver=)([0-9]+.[0-9]+(?:.[0-9]+)?)'\n\n      - type: regex\n        name: wordpress-version\n        part: body\n        group: 1\n        regex:\n          - '(?:content=\"WordPress |wordpress.org\/?v=|generator=\"WordPress\/|\/wp-includes\/[^\"s&gt;]*?ver=)([0-9]+.[0-9]+(?:.[0-9]+)?)'<\/code><\/pre>\n<p>Save it as <code>CVE-2026-63030.yaml<\/code> and run it against a single target or a list of hosts:<\/p>\n<pre><code># Single target\nnuclei -t CVE-2026-63030.yaml -u https:\/\/example.com\/\n\n# A whole list of WordPress hosts\nnuclei -t CVE-2026-63030.yaml -l wordpress-hosts.txt\n\n# Example match against an affected 7.0.1 instance:\n[CVE-2026-63030] [http] [critical] https:\/\/example.com\/ [affected-7.0.0-through-7.0.1] [7.0.1]<\/code><\/pre>\n<p>The named matchers tell you which branch matched (<code>affected-6.9.0-through-6.9.4<\/code> or <code>affected-7.0.0-through-7.0.1<\/code>) and the extracted version appears in the results, so triage is immediate. Because the check is version-based, its one blind spot is the same as the manual checks: a site that strips every version marker cannot be fingerprinted remotely. For those, and for anyone who needs defensible coverage across an entire estate, the next step up is Sn1per.<\/p>\n<h2 id=\"detection-at-scale\">Detecting wp2shell across your attack surface with Sn1per<\/h2>\n<p>One template against one URL is fine for a spot check. The real problem is scale and discovery: most organizations do not have a clean list of every WordPress instance they expose. A shadow marketing microsite, a forgotten staging blog, a subsidiary&rsquo;s WordPress on a recently acquired domain &#8211; those are exactly the hosts that miss the forced auto-update and quietly sit on 7.0.1 for weeks. Finding them is an <a href=\"\/wordpress\/external-attack-surface-management-with-sn1per\/\">attack-surface problem<\/a> before it is a scanning problem.<\/p>\n<p>Sn1per is built for that. It runs discovery and detection as one engine: it enumerates the surface (subdomains, live hosts, services, technologies), fingerprints what is running, and runs its curated Nuclei set &#8211; including this wp2shell template &#8211; against everything it finds, into a persistent named workspace. Instead of &ldquo;scan this one URL,&rdquo; the workflow becomes &ldquo;discover every WordPress we expose and flag the ones on an affected version.&rdquo;<\/p>\n<pre><code># Discover the surface, then run web detections (incl. the wp2shell template)\n# into a persistent workspace\nsniper -t example.com -m recon -w acme-wp\nsniper -t example.com -m web   -w acme-wp\n\n# Pull the affected-version findings back out via the JSON API (Sn1per Professional 2026)\ncurl -sk -H \"X-API-Key: $SN1PER_API_KEY\" \n  \"https:\/\/sn1per.local\/pro\/api.php?action=vulnerabilities&amp;workspace=acme-wp\" | jq '.'<\/code><\/pre>\n<p>Because Sn1per keeps results in workspaces, the same command from cron or a CI\/CD pipeline re-checks the surface on a schedule, so a newly discovered or freshly stood-up WordPress gets fingerprinted within a run rather than at the next annual pentest &#8211; the model we cover in <a href=\"\/wordpress\/continuous-attack-surface-testing\/\">continuous attack surface testing<\/a> and <a href=\"\/wordpress\/automated-penetration-testing\/\">automated penetration testing<\/a>. Findings also feed Sn1per&rsquo;s correlation layer, so a wp2shell hit on a host that also exposes other weaknesses is ranked in context rather than as an isolated line item.<\/p>\n<p>And because Sn1per is self-hosted &#8211; it has run on-prem since 2015 and is Docker-first &#8211; the entire scan, including the target list of your unpatched WordPress sites, never leaves your perimeter. For an offensive-security tool inventorying your own exposure, that <a href=\"\/wordpress\/best-on-prem-external-attack-surface-management-platform\/\">on-prem posture<\/a> is the point: a map of what you have not patched yet is precisely the data you do not want sitting in someone else&rsquo;s cloud.<\/p>\n<h3 id=\"edition-comparison\">Which Sn1per edition fits<\/h3>\n<table>\n<thead>\n<tr>\n<th>Capability<\/th>\n<th>Community Edition<\/th>\n<th>Professional 2026<\/th>\n<th>Enterprise<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Curated Nuclei set incl. wp2shell template<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Discovery + detection engine<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Scale<\/td>\n<td>Single operator<\/td>\n<td>Up to 150 assets, single operator<\/td>\n<td>Near-unlimited, multi-operator<\/td>\n<\/tr>\n<tr>\n<td>Web UI + scheduled scans<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>JSON API + SIEM \/ ticketing export<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Multi-workspace \/ multi-team<\/td>\n<td>No<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Self-hosted \/ on-prem<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><a href=\"\/wordpress\/sn1per-community-edition\/\">Sn1per Community Edition<\/a> is free and open-source and ships the same detection engine, so a spot check across a handful of hosts costs nothing. <a href=\"\/wordpress\/sn1per-professional-2026\/\">Sn1per Professional 2026<\/a> adds the web UI, scheduled scans, and the JSON API for teams that want continuous coverage and findings routed into a SIEM or ticket queue; live pricing is on the <a href=\"\/wordpress\/shop\/\">shop<\/a>. <a href=\"\/wordpress\/sn1per-enterprise\/\">Sn1per Enterprise<\/a> scales to near-unlimited assets with multi-operator, multi-workspace management for MSSPs and large security teams (custom quote). If you are weighing the two paid tiers, our <a href=\"\/wordpress\/sn1per-professional-vs-sn1per-enterprise-a-comprehensive-comparison\/\">Professional vs Enterprise comparison<\/a> breaks it down.<\/p>\n<h2 id=\"remediation\">Remediation and mitigation<\/h2>\n<p><strong>1. Patch. This is the only real fix.<\/strong> Update Core to 7.0.2 (7.0 branch), 6.9.5 (6.9 branch), or 6.8.6 (6.8 branch). WordPress forced auto-updates for affected versions, but verify rather than assume it completed &#8211; confirm with <code>wp core version<\/code> on every internet-facing instance you own.<\/p>\n<p><strong>2. If you cannot patch immediately, block the batch endpoint at the WAF.<\/strong> Every temporary mitigation reduces to the same idea: keep anonymous callers off the batch endpoint. Block <em>both<\/em> routes &#8211; a rule that only covers the path leaves the query-string route open:<\/p>\n<pre><code># Both of these must be blocked for anonymous users:\n\/wp-json\/batch\/v1\n\/?rest_route=\/batch\/v1<\/code><\/pre>\n<p>Options include a WAF rule blocking both routes, disabling unauthenticated REST access, or a small must-use plugin that rejects anonymous batch requests. Treat these as stopgaps: they can break legitimate REST integrations, and they are not a substitute for patching.<\/p>\n<p><strong>3. Verify integrity after patching.<\/strong> If a host was on an affected version and internet-exposed during the window, confirm the update landed cleanly and the core files are intact with <code>wp core verify-checksums<\/code>. Given no confirmed in-the-wild exploitation at disclosure, the risk during the short window was low, but the check is cheap.<\/p>\n<h2 id=\"faq\">Frequently asked questions<\/h2>\n<p><strong>What is wp2shell?<\/strong> wp2shell is the nickname for CVE-2026-63030, a pre-authentication remote code execution chain in WordPress Core. It combines a REST API batch-route confusion (CVE-2026-63030) with a SQL injection in WP_Query (CVE-2026-60137) so that an anonymous, unauthenticated attacker can reach code execution on a default WordPress install with no plugins.<\/p>\n<p><strong>Which WordPress versions are affected?<\/strong> The RCE chain affects WordPress Core 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. It is fixed in 7.0.2, 6.9.5, and 6.8.6, released on July 17, 2026. WordPress 6.8.0 through 6.8.5 is exposed to the standalone SQL injection and should move to 6.8.6; versions below 6.8 are not affected by either issue.<\/p>\n<p><strong>Is there a public exploit, and is it being exploited?<\/strong> At disclosure there was no public proof-of-concept and no confirmed in-the-wild exploitation, and the researchers withheld the final exploit primitive. Because WordPress is open source, a working exploit is expected to be reconstructed quickly from the patch, so patching promptly is important.<\/p>\n<p><strong>How do I detect wp2shell across many sites?<\/strong> Use the Nuclei template in this post for a version-based check against a single host or a list. To cover an entire attack surface, including WordPress instances you may not have inventoried, use Sn1per, which discovers hosts and runs the same template into a persistent workspace on a schedule.<\/p>\n<p><strong>Is the Nuclei template safe to run in production?<\/strong> Yes. It only reads public version markers (the generator tag, RSS and OPML generators, and core asset version strings) and compares the version against the affected ranges. It sends no exploit traffic and does not attempt the SQL injection or the batch-route confusion, so it is safe against production targets.<\/p>\n<p>wp2shell is the kind of vulnerability that punishes incomplete inventory more than slow patching: the sites that get compromised are the ones nobody remembered they had. Patch what you know about today, then use the template above &#8211; or <a href=\"\/wordpress\/sn1per-community-edition\/\">Sn1per<\/a> across your whole surface &#8211; to find the WordPress you forgot.<\/p>\n<p><script type=\"application\/ld+json\">\n{\"@context\":\"https:\/\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[\n{\"@type\":\"Question\",\"name\":\"What is wp2shell?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"wp2shell is the nickname for CVE-2026-63030, a pre-authentication remote code execution chain in WordPress Core. It combines a REST API batch-route confusion (CVE-2026-63030) with a SQL injection in WP_Query (CVE-2026-60137) so that an anonymous, unauthenticated attacker can reach code execution on a default WordPress install with no plugins installed.\"}},\n{\"@type\":\"Question\",\"name\":\"Which WordPress versions are affected by CVE-2026-63030?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The wp2shell RCE chain affects WordPress Core 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. It is fixed in 7.0.2, 6.9.5, and 6.8.6, released on July 17, 2026. WordPress 6.8.0 through 6.8.5 is exposed to the standalone SQL injection and should update to 6.8.6; versions below 6.8 are not affected by either issue.\"}},\n{\"@type\":\"Question\",\"name\":\"Is there a public exploit for wp2shell, and is it being exploited?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"At the time of disclosure there was no public proof-of-concept and no confirmed in-the-wild exploitation, and the researchers withheld the final exploit primitive to give defenders time to patch. Because WordPress is open source, a working exploit is expected to be reconstructed quickly from the patch diff, so patching promptly is important.\"}},\n{\"@type\":\"Question\",\"name\":\"How do I detect wp2shell across many sites?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Use the Nuclei template in this advisory for a version-based check against a single host or a list of hosts. To cover an entire attack surface, including WordPress instances you may not have inventoried, use Sn1per, which discovers hosts and runs the same template into a persistent workspace on a schedule.\"}},\n{\"@type\":\"Question\",\"name\":\"Is the wp2shell Nuclei template safe to run in production?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes. The template only reads public version markers such as the generator meta tag, the RSS and OPML generators, and core asset version strings, then compares the detected version against the affected ranges. It sends no exploit traffic and does not attempt the SQL injection or the batch-route confusion, so it is safe to run against production targets.\"}}\n]}\n<\/script><\/p>\n<div id=\"wp-share-button-65281\" class=\"wp-share-button theme28\"><span class=\"total-share \"><i class=\"total-count-text\">Total Share<\/i> <i class=\"total-count\">0<\/i> <\/span><a target=\"_blank\" href=\"https:\/\/www.facebook.com\/sharer\/sharer.php?u=https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/\" class=\"share-button share-button-65281 facebook\" id=\"facebook\" data-nonce=\"1a3e7b7094\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Facebook<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a target=\"_blank\" href=\"https:\/\/twitter.com\/intent\/tweet?url=https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/&amp;text=wp2shell%20(CVE-2026-63030):%20Unauthenticated%20Pre-Auth%20RCE%20in%20WordPress%20Core%20\u2013%20Advisory%20+%20Nuclei%20Detection\" class=\"share-button share-button-65281 twitter\" id=\"twitter\" data-nonce=\"1a3e7b7094\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Twitter<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a target=\"_blank\" href=\"http:\/\/www.reddit.com\/submit?title=wp2shell%20(CVE-2026-63030):%20Unauthenticated%20Pre-Auth%20RCE%20in%20WordPress%20Core%20\u2013%20Advisory%20+%20Nuclei%20Detection&amp;url=https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/\" class=\"share-button share-button-65281 reddit\" id=\"reddit\" data-nonce=\"1a3e7b7094\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Reddit<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a target=\"_blank\" href=\"https:\/\/www.linkedin.com\/shareArticle?url=https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/&amp;title=wp2shell%20(CVE-2026-63030):%20Unauthenticated%20Pre-Auth%20RCE%20in%20WordPress%20Core%20\u2013%20Advisory%20+%20Nuclei%20Detection&amp;summary=&amp;source=\" class=\"share-button share-button-65281 linkedin\" id=\"linkedin\" data-nonce=\"1a3e7b7094\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Linkedin<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a title=\"More...\" href=\"#wp-share-button-65281\" class=\"share-button-more\"><span class=\"button-icon\"><i class=\"fa fa-plus\"><\/i><\/span><\/a><div class=\"wp-share-button-popup wp-share-button-popup-65281\"><div class=\"popup-buttons\"><span class=\"close\">X<\/span><a target=\"_blank\" href=\"mailto:?subject=wp2shell%20(CVE-2026-63030):%20Unauthenticated%20Pre-Auth%20RCE%20in%20WordPress%20Core%20\u2013%20Advisory%20+%20Nuclei%20Detection&amp;body=https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/\" class=\"share-button share-button-65281 email\" id=\"email\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Email<\/span>\r\n<span class=\"button-count\">0<\/span>\t\t\t\t\r\n\r\n<\/a>\r\n<\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"<p>wp2shell (CVE-2026-63030) is an unauthenticated pre-auth RCE in WordPress Core 6.9.0-6.9.4 and 7.0.0-7.0.1. A plain-English advisory, a ready-to-run Nuclei detection template, remediation, and how to detect affected WordPress at scale with Sn1per.<\/p>\n","protected":false},"author":1,"featured_media":65282,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[290,80,99,184,289,338,335],"tags":[359,433,432,437,37,366,436,434,438,435,431],"class_list":["post-65281","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-attack-surface-management","category-bug-bounties","category-cves","category-news","category-penetration-testing","category-threat-intelligence","category-vulnerability-scanning","tag-359","tag-cve-2026-60137","tag-cve-2026-63030","tag-nuclei-template","tag-sn1per","tag-sn1per-pro","tag-unauthenticated-rce","tag-wordpress-rce","tag-wordpress-security","tag-wordpress-vulnerability","tag-wp2shell"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"wp2shell (CVE-2026-63030) is an unauthenticated RCE in WordPress Core 6.9.0-6.9.4 and 7.0.0-7.0.1. Get the Nuclei detection template and scan for it at scale with Sn1per.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"xer0dayz\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Sn1perSecurity\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"wp2shell (CVE-2026-63030): WordPress RCE Detection | Sn1per\" \/>\n\t\t<meta property=\"og:description\" content=\"wp2shell (CVE-2026-63030) is an unauthenticated RCE in WordPress Core 6.9.0-6.9.4 and 7.0.0-7.0.1. Get the Nuclei detection template and scan for it at scale with Sn1per.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/wp2shell-cve-2026-63030.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/wp2shell-cve-2026-63030.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-07-18T19:00:36+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-18T19:00:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Sn1persecurity-105784611869093\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@sn1persecurity\" \/>\n\t\t<meta name=\"twitter:title\" content=\"wp2shell (CVE-2026-63030): WordPress RCE Detection | Sn1per\" \/>\n\t\t<meta name=\"twitter:description\" content=\"wp2shell (CVE-2026-63030) is an unauthenticated RCE in WordPress Core 6.9.0-6.9.4 and 7.0.0-7.0.1. Get the Nuclei detection template and scan for it at scale with Sn1per.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@sn1persecurity\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/wp2shell-cve-2026-63030.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\\\/#blogposting\",\"name\":\"wp2shell (CVE-2026-63030): WordPress RCE Detection | Sn1per\",\"headline\":\"wp2shell (CVE-2026-63030): Unauthenticated Pre-Auth RCE in WordPress Core &#8211; Advisory + Nuclei Detection\",\"author\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/wp2shell-cve-2026-63030.png\",\"width\":1200,\"height\":630,\"caption\":\"Sn1perSecurity advisory cover: wp2shell (CVE-2026-63030) unauthenticated pre-auth RCE in WordPress Core, with a Nuclei detection template and Sn1per attack surface detection\"},\"datePublished\":\"2026-07-18T12:00:36-07:00\",\"dateModified\":\"2026-07-18T12:00:36-07:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\\\/#webpage\"},\"articleSection\":\"Attack Surface Management, Bug Bounties, CVE's, News, Penetration Testing, Threat Intelligence, Vulnerability Scanning, 2026, cve-2026-60137, cve-2026-63030, nuclei-template, sn1per, sn1per pro, unauthenticated-rce, wordpress-rce, wordpress-security, wordpress-vulnerability, wp2shell\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/bug-bounties\\\/#listItem\",\"name\":\"Bug Bounties\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/bug-bounties\\\/#listItem\",\"position\":2,\"name\":\"Bug Bounties\",\"item\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/bug-bounties\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\\\/#listItem\",\"name\":\"wp2shell (CVE-2026-63030): Unauthenticated Pre-Auth RCE in WordPress Core &#8211; Advisory + Nuclei Detection\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\\\/#listItem\",\"position\":3,\"name\":\"wp2shell (CVE-2026-63030): Unauthenticated Pre-Auth RCE in WordPress Core &#8211; Advisory + Nuclei Detection\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/bug-bounties\\\/#listItem\",\"name\":\"Bug Bounties\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#organization\",\"name\":\"Sn1perSecurity\",\"description\":\"Get an attacker's view of your organization with our all-in-one offensive security platform\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/\",\"email\":\"support@sn1persecurity.com\",\"foundingDate\":\"2021-10-05\",\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"value\":2},\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/Sn1perwhiteandcircleicontwitter.jpg\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\\\/#organizationLogo\",\"width\":500,\"height\":500,\"caption\":\"Sn1perSecurity Logo\"},\"image\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/Sn1persecurity-105784611869093\",\"https:\\\/\\\/x.com\\\/sn1persecurity\",\"https:\\\/\\\/www.instagram.com\\\/sn1persecurity\",\"https:\\\/\\\/www.youtube.com\\\/sn1persecurity\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/sn1persecurity\\\/\",\"https:\\\/\\\/github.com\\\/1N3\\\/Sn1per\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/\",\"name\":\"xer0dayz\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/60111840c4f5a576635c5b9169e7322cec38bea67f56f0c141021c7579f230a4?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"xer0dayz\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\\\/#webpage\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\\\/\",\"name\":\"wp2shell (CVE-2026-63030): WordPress RCE Detection | Sn1per\",\"description\":\"wp2shell (CVE-2026-63030) is an unauthenticated RCE in WordPress Core 6.9.0-6.9.4 and 7.0.0-7.0.1. Get the Nuclei detection template and scan for it at scale with Sn1per.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/wp2shell-cve-2026-63030.png\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Sn1perSecurity advisory cover: wp2shell (CVE-2026-63030) unauthenticated pre-auth RCE in WordPress Core, with a Nuclei detection template and Sn1per attack surface detection\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\\\/#mainImage\"},\"datePublished\":\"2026-07-18T12:00:36-07:00\",\"dateModified\":\"2026-07-18T12:00:36-07:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#website\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/\",\"name\":\"Sn1perSecurity\",\"alternateName\":\"Sn1per\",\"description\":\"Get an attacker's view of your organization with our all-in-one offensive security platform\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"wp2shell (CVE-2026-63030): WordPress RCE Detection | Sn1per","description":"wp2shell (CVE-2026-63030) is an unauthenticated RCE in WordPress Core 6.9.0-6.9.4 and 7.0.0-7.0.1. Get the Nuclei detection template and scan for it at scale with Sn1per.","canonical_url":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/#blogposting","name":"wp2shell (CVE-2026-63030): WordPress RCE Detection | Sn1per","headline":"wp2shell (CVE-2026-63030): Unauthenticated Pre-Auth RCE in WordPress Core &#8211; Advisory + Nuclei Detection","author":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author"},"publisher":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/wp2shell-cve-2026-63030.png","width":1200,"height":630,"caption":"Sn1perSecurity advisory cover: wp2shell (CVE-2026-63030) unauthenticated pre-auth RCE in WordPress Core, with a Nuclei detection template and Sn1per attack surface detection"},"datePublished":"2026-07-18T12:00:36-07:00","dateModified":"2026-07-18T12:00:36-07:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/#webpage"},"isPartOf":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/#webpage"},"articleSection":"Attack Surface Management, Bug Bounties, CVE's, News, Penetration Testing, Threat Intelligence, Vulnerability Scanning, 2026, cve-2026-60137, cve-2026-63030, nuclei-template, sn1per, sn1per pro, unauthenticated-rce, wordpress-rce, wordpress-security, wordpress-vulnerability, wp2shell"},{"@type":"BreadcrumbList","@id":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress#listItem","position":1,"name":"Home","item":"https:\/\/sn1persecurity.com\/wordpress","nextItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/#listItem","name":"Bug Bounties"}},{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/#listItem","position":2,"name":"Bug Bounties","item":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/","nextItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/#listItem","name":"wp2shell (CVE-2026-63030): Unauthenticated Pre-Auth RCE in WordPress Core &#8211; Advisory + Nuclei Detection"},"previousItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/#listItem","position":3,"name":"wp2shell (CVE-2026-63030): Unauthenticated Pre-Auth RCE in WordPress Core &#8211; Advisory + Nuclei Detection","previousItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/#listItem","name":"Bug Bounties"}}]},{"@type":"Organization","@id":"https:\/\/sn1persecurity.com\/wordpress\/#organization","name":"Sn1perSecurity","description":"Get an attacker's view of your organization with our all-in-one offensive security platform","url":"https:\/\/sn1persecurity.com\/wordpress\/","email":"support@sn1persecurity.com","foundingDate":"2021-10-05","numberOfEmployees":{"@type":"QuantitativeValue","value":2},"logo":{"@type":"ImageObject","url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1perwhiteandcircleicontwitter.jpg","@id":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/#organizationLogo","width":500,"height":500,"caption":"Sn1perSecurity Logo"},"image":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/#organizationLogo"},"sameAs":["https:\/\/www.facebook.com\/Sn1persecurity-105784611869093","https:\/\/x.com\/sn1persecurity","https:\/\/www.instagram.com\/sn1persecurity","https:\/\/www.youtube.com\/sn1persecurity","https:\/\/www.linkedin.com\/in\/sn1persecurity\/","https:\/\/github.com\/1N3\/Sn1per"]},{"@type":"Person","@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author","url":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/","name":"xer0dayz","image":{"@type":"ImageObject","@id":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/60111840c4f5a576635c5b9169e7322cec38bea67f56f0c141021c7579f230a4?s=96&d=mm&r=g","width":96,"height":96,"caption":"xer0dayz"}},{"@type":"WebPage","@id":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/#webpage","url":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/","name":"wp2shell (CVE-2026-63030): WordPress RCE Detection | Sn1per","description":"wp2shell (CVE-2026-63030) is an unauthenticated RCE in WordPress Core 6.9.0-6.9.4 and 7.0.0-7.0.1. Get the Nuclei detection template and scan for it at scale with Sn1per.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/#website"},"breadcrumb":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/#breadcrumblist"},"author":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author"},"creator":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/wp2shell-cve-2026-63030.png","@id":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/#mainImage","width":1200,"height":630,"caption":"Sn1perSecurity advisory cover: wp2shell (CVE-2026-63030) unauthenticated pre-auth RCE in WordPress Core, with a Nuclei detection template and Sn1per attack surface detection"},"primaryImageOfPage":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/#mainImage"},"datePublished":"2026-07-18T12:00:36-07:00","dateModified":"2026-07-18T12:00:36-07:00"},{"@type":"WebSite","@id":"https:\/\/sn1persecurity.com\/wordpress\/#website","url":"https:\/\/sn1persecurity.com\/wordpress\/","name":"Sn1perSecurity","alternateName":"Sn1per","description":"Get an attacker's view of your organization with our all-in-one offensive security platform","inLanguage":"en-US","publisher":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/#organization"}}]},"og:locale":"en_US","og:site_name":"Sn1perSecurity","og:type":"article","og:title":"wp2shell (CVE-2026-63030): WordPress RCE Detection | Sn1per","og:description":"wp2shell (CVE-2026-63030) is an unauthenticated RCE in WordPress Core 6.9.0-6.9.4 and 7.0.0-7.0.1. Get the Nuclei detection template and scan for it at scale with Sn1per.","og:url":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/","og:image":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/wp2shell-cve-2026-63030.png","og:image:secure_url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/wp2shell-cve-2026-63030.png","og:image:width":"1200","og:image:height":"630","article:published_time":"2026-07-18T19:00:36+00:00","article:modified_time":"2026-07-18T19:00:36+00:00","article:publisher":"https:\/\/www.facebook.com\/Sn1persecurity-105784611869093","twitter:card":"summary_large_image","twitter:site":"@sn1persecurity","twitter:title":"wp2shell (CVE-2026-63030): WordPress RCE Detection | Sn1per","twitter:description":"wp2shell (CVE-2026-63030) is an unauthenticated RCE in WordPress Core 6.9.0-6.9.4 and 7.0.0-7.0.1. Get the Nuclei detection template and scan for it at scale with Sn1per.","twitter:creator":"@sn1persecurity","twitter:image":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/wp2shell-cve-2026-63030.png"},"aioseo_meta_data":{"post_id":"65281","title":"wp2shell (CVE-2026-63030): WordPress RCE Detection | Sn1per","description":"wp2shell (CVE-2026-63030) is an unauthenticated RCE in WordPress Core 6.9.0-6.9.4 and 7.0.0-7.0.1. Get the Nuclei detection template and scan for it at scale with Sn1per.","keywords":null,"keyphrases":{"focus":{"keyphrase":"wp2shell","score":0,"analysis":[]}},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"featured","og_image_url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/wp2shell-cve-2026-63030.png","og_image_width":"1200","og_image_height":"630","og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":true,"twitter_card":"summary_large_image","twitter_image_type":"featured","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":true,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2026-07-18 19:00:41","updated":"2026-07-18 19:01:42","seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/sn1persecurity.com\/wordpress\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/\" title=\"Bug Bounties\">Bug Bounties<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\twp2shell (CVE-2026-63030): Unauthenticated Pre-Auth RCE in WordPress Core \u2013 Advisory + Nuclei Detection\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/sn1persecurity.com\/wordpress"},{"label":"Bug Bounties","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/"},{"label":"wp2shell (CVE-2026-63030): Unauthenticated Pre-Auth RCE in WordPress Core &#8211; Advisory + Nuclei Detection","link":"https:\/\/sn1persecurity.com\/wordpress\/wp2shell-cve-2026-63030-wordpress-rce-detection-with-sn1per\/"}],"jetpack_featured_media_url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/wp2shell-cve-2026-63030.png","jetpack_shortlink":"https:\/\/wp.me\/pdnW96-gYV","jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/posts\/65281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/comments?post=65281"}],"version-history":[{"count":0,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/posts\/65281\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/media\/65282"}],"wp:attachment":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/media?parent=65281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/categories?post=65281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/tags?post=65281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}