Summary：**Alarming WordPress Exploit Chain Enables Unauthenticated Remote Code Execution** *Summary: A Word

referrerpolicy="no-referrer"
style="max-width:100%;height:auto;display:block;margin:0 auto;">

**Alarming WordPress Exploit Chain Enables Unauthenticated Remote Code Execution**
*Summary: A WordPress Core vulnerability chain, publicly nicknamed wp2shell, combines CVE-2026-63030 (CVSS 9.8) and CVE-2026-60137 (CVSS 5.9) for pre‑authentication remote code execution (RCE). The exploit chain affects WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0…*

---

### Introduction
Security researchers disclosed a two‑step flaw in WordPress that lets attackers run arbitrary code on a server without needing any credentials. Dubbed **wp2shell**, the chain stitches together **CVE‑2026-63030**, a high‑severity deserialization bug in the REST API, and **CVE‑2026-60137**, a medium‑severity path‑traversal issue in the theme editor. When chained, the vulnerabilities bypass authentication checks and grant unauthenticated remote code execution (RCE) on sites running WordPress 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.1. The disclosure has prompted urgent calls for administrators to apply the latest patches.

### Key Developments
The wp2shell exploit was first demonstrated in a proof‑of‑concept video posted on a public security forum. The attack begins by sending a specially crafted JSON payload to the `/wp-json/wp/v2/users` endpoint, triggering the deserialization flaw (CVE‑2026-63030). This step allows the attacker to inject a serialized object that, when processed, writes a malicious file to the server’s upload directory. The second step leverages CVE‑2026-60137 to traverse from the uploads folder into the active theme’s directory, where the injected file is executed as PHP code. Because both flaws are reachable before login, an