Critical wp2shell RCE Vulnerability – Complete Coverage Including PoC and Active Exploitation Details

A critical pre-authentication remote code execution (RCE) vulnerability chain nicknamed “wp2shell” has been disclosed in WordPress Core, putting an estimated 500 million-plus websites at risk of full takeover by completely unauthenticated attackers. The chain combines two separately tracked flaws CVE-2026-63030, a REST API batch-route confusion issue, and CVE-2026-60137, a SQL injection vulnerability in the author__not_in parameter of WP_Query to achieve full server compromise on a stock WordPress installation with zero plugins installed. WordPress powers roughly 43 percent of all websites globally, making this one of the most consequential CMS security disclosures in recent memory. What sets wp2shell apart from typical WordPress security issues is that it requires no preconditions whatsoever: no valid account, no vulnerable plugin, no special configuration, and no user interaction. Any anonymous attacker capable of reaching a vulnerable WordPress instance over the network can compromise it out of the box. The flaw was uncovered by security researcher Adam Kues of Searchlight Cyber’s Assetnote research team, using an unconventional method: an AI-driven vulnerability research project powered by OpenAI’s GPT-5.6 Sol Ultra model.…