THREAT OPS › CVEs › CVE-2026-63030
CVE-2026-63030 — WordPress Core Interpretation Conflict Vulnerability
WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.
Vulnerability details
- Affected productsCore
- KEV remediation due2026-07-24
Related reporting
- August 2026 CVE Landscaperecordedfuture
- Metasploit Wrap Up: Lot of summer shells and fit http profilesrapid7
- July 2026 CVE Landscaperecordedfuture
- wp2shell Aftermath: The First Critical Unauthenticated WordPress Core RCE in Nearly a Decadewordfence
- CVE-2026-63030 and CVE-2026-60137: Mitigating a Critical Unauthenticated RCE Chain in WordPressakamai_blog
- WordPress security advisory (AV26-723) - Update 1cccs_ca
- Exploitation in the Wild of wp2shellwiz_research
- Wordfence Intelligence Weekly WordPress Vulnerability Report (July 13, 2026 to July 19, 2026)wordfence
- wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command executionelastic_security
- Don’t swing at everythingtalos
- wp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Coretenable
- WordPress Core Pre-Auth RCE Chain Exploited in the Wildorca_security
- 20th July – Threat Intelligence Reportcheckpoint_research
- CISA Adds Four Known Exploited Vulnerabilities to Catalogcisa_advisories
- [CISA KEV] CVE-2026-60137 — WordPress Core: WordPress Core SQL Injection Vulnerabilitycisa_kev
- [CISA KEV] CVE-2026-63030 — WordPress Core: WordPress Core Interpretation Conflict Vulnerabilitycisa_kev
- WP2Shell WordPress Exploit Technical Analysis and Real Attack Datawordfence
- PSA: WordPress Core Patched Unauthenticated Remote Code Execution Vulnerability Chainwordfence
- CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Corerapid7
- CVE-2026-60137 / CVE-2026-63030 | WordPress Core SQL Injection and Pre-Authentication Remote Code Execution Vulnerabilitieshorizon3
- WordPress Multiple Vulnerabilitieshkcert