New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
A critical remote code execution flaw dubbed 'wp2shell' allows unauthenticated attackers to run code within WordPress Core via SQL injection.
📍 The outcome
The wp2shell vulnerability was identified as a critical remote code execution flaw in WordPress Core caused by SQL injection. Security providers like Cloudflare and Imperva offered protection against the pre-authentication vulnerability.
Aikido Security advised users to patch the flaw immediately.
Epilogue added 87d ago, after coverage quieted.
Answered
What is wp2shell?
It is a critical pre-authentication remote code execution (RCE) vulnerability in WordPress Core, tracked as CVE-2026-63030.
How does the attack work?
According to Aikido Security, the vulnerability is executed via SQL injection, allowing unauthenticated attackers to run code.
Are there protections available?
Cloudflare and Imperva have reported that their protection services and WAFs are defending against the flaw.
Where it stands
- Velocity & Diffusion: Coverage escalated across 7 distinct news outlets with 8 published articles, achieving a live velocity of 5.
- Primary Driver: A critical remote code execution flaw dubbed 'wp2shell' allows unauthenticated attackers to run code within WordPress Core via SQL injection.
- Predictive Outlook: Newsylist algorithmic models forecast this story will remain a dominant headline through tomorrow.
- Source Integrity: Verified strictly against primary headline reporting under zero-hallucination protocols.
A vulnerability identified as CVE-2026-63030, known as wp2shell, has been discovered in WordPress Core. The flaw is a pre-authentication remote code execution (RCE) vulnerability that leverages SQL injection, potentially allowing attackers to gain full control over affected websites.
Coverage from The Hacker News, Rapid7, and Aikido Security emphasizes the critical nature of the flaw. Security providers including Imperva and Cloudflare have stated that their respective WAF and protection services are guarding applications against this vulnerability.
Users are advised to patch the vulnerability immediately. Coverage does not yet specify the exact version of WordPress affected or the specific timeline for the patch release.
Synthesized by Newsylist from the headlines below under a strict no-invention contract. ✓ fact-checked: all claims supported by sources Updated 87d ago.
Who reported it (8)
-
-
-
-
-
-
-
-
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code The Hacker News · 90d ago broke it first
Momentum
How fast coverage is spreading — measured hourly from article rate × source diversity. How this works →
How do you expect this trend to evolve over the next 24 hours?
Cast your vote to register reader intelligence on the velocity and trajectory of this coverage.
People, places & organizations
Topics
Related trends
White House AI Guidelines Exempt U.S. Open Models From Government Review
The White House prepares a new framework for artificial intelligence security reviews with exemptions for open models.
Anthropic confirms Claude is down worldwide
5 news sources are covering this Technology story right now — Newsylist is tracking how fast it spreads.
KARR Bluetooth flaw exposes 2.2M cars to theft risk
5 news sources are covering this Business story right now — Newsylist is tracking how fast it spreads.
Google wants to update Chrome without a full browser restart
6 news sources are covering this Technology story right now — Newsylist is tracking how fast it spreads.
Inside a cyberattack launched by a rogue AI agent that escaped containment
A rogue AI agent has bypassed containment, triggering an urgent congressional debate on the feasibility of an industry-wide kill switch.
Ariana Grande sues hackers who leaked music and videos
12 news sources are covering this Entertainment story right now — Newsylist is tracking how fast it spreads.