# New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

> **Newsylist Open Intelligence Dossier** · First detected: 2026-07-18 04:29 UTC · Category: Technology · Sources: 7 · Current Velocity: 5.29

## Executive Summary
A critical remote code execution flaw dubbed 'wp2shell' allows unauthenticated attackers to run code within WordPress Core via SQL injection.

## Intelligence Brief
A vulnerability identified as CVE-2026-63030, known as wp2shell, has been discovered in WordPress Core. The flaw is a pre-authentication remote code execution (RCE) vulnerability that leverages SQL injection, potentially allowing attackers to gain full control over affected websites.


Coverage from The Hacker News, Rapid7, and Aikido Security emphasizes the critical nature of the flaw. Security providers including Imperva and Cloudflare have stated that their respective WAF and protection services are guarding applications against this vulnerability.


Users are advised to patch the vulnerability immediately. Coverage does not yet specify the exact version of WordPress affected or the specific timeline for the patch release.

## Verified Facts & Key Claims
### What is wp2shell?
It is a critical pre-authentication remote code execution (RCE) vulnerability in WordPress Core, tracked as CVE-2026-63030.

### How does the attack work?
According to Aikido Security, the vulnerability is executed via SQL injection, allowing unauthenticated attackers to run code.

### Are there protections available?
Cloudflare and Imperva have reported that their protection services and WAFs are defending against the flaw.

## Key People, Organizations & Locations
WordPress, WordPress Core Flaw Lets Unauthenticated Attackers Run Code, Critical Wordpress Plugin Vulnerability Allows Attackers, Gain Full Control Over Website, CVE-2026-63030, Critical Remote Code Execution Vulnerability, WordPress Core, Unauthenticated RCE Vulnerability, A Pre-Authentication RCE, WordPress Core and Why It Is

## Multi-Source Evidence Table
| Source Outlet | Headline | Published (UTC) | Verification URL |
|---|---|---|---|
| Security Boulevard | Imperva Customers Protected Against “wp2shell” Pre-Authentication RCE in WordPress Core | 2026-07-17 21:20 | [Source Link](https://news.google.com/rss/articles/CBMiwgFBVV95cUxNUkgxeklkSWFobzllUVZMN3ZrcEt5Z2oxaHJZS0l2amdnbG9wTEFPVm9LYzNNMUx5eVlQS3g1Q0FXQUhTamxaOEdPRlpkaVdoUGJYQ1pQcHJ3bF9XUTg4Zy01eXN2WnFZWUp3TE9MbjNGM1lPV0VOS1lYdWJSblpVbmhTdHhnRWs3S29iaGMzX3k2REdBR2pXWTBUUjJaTng3akJ5Qks2N3F2dWRPR3A4VUFlY2NnS2Y4bVRLcW9HTUhpQQ?oc=5) |
| Security Boulevard | wp2shell: A Pre-Authentication RCE in WordPress Core, and Why It Is an Exposure Validation Problem | 2026-07-17 21:20 | [Source Link](https://news.google.com/rss/articles/CBMi0AFBVV95cUxQXzBMc2g1OFdoSmotcm9mc1VjdmgzeGlSYXBNVHVrQXRFUVV5bzlQeF9RcVJDeE9pN19ycW0tN0FZYVNCRVF3UUdqY0FxYkNTbFJCaXNHQUZIdnhBTk9PUmdnRjFuVWo1cFI4ZXVnMUZNc3dXUk41UnJ0NXpHR2M1NnhQVDRGMzlVVmNNUFhHa0VBRFYzb3NEZnpmX2VtZ1M1eVpCbnBzTnB5djI3UXFzZElMUDJNNndtbnlPeXNpTGdWb1BCY2xnaV9aZWJJdVl4?oc=5) |
| TipRanks | Aikido Security Highlights WordPress Vulnerability and Positions Runtime Protection Offering | 2026-07-17 21:20 | [Source Link](https://news.google.com/rss/articles/CBMi1wFBVV95cUxPNVg5cGNDVW9tU05tMThuMlY0blZFSlhNM05WdElVWUdYVFdXZG9pSUJaUGxDejF6UmU3RGpQT1h4bVRra2JlRXYza1U4aXNYR01yM3NVZ0RhQTdLdkpNQ0N4Qm0wcC1BeG1JTUx6NFhFV21HVDFfQ2FVMWp1TWdwM3RUVF9EU1FlTGJseHB3dTFfZDJVMi1NbWVMX0tmQWtQbXNCX29lel9EOTEweTdON0h2NWN3SGctNDNNSHROZTZ1aDAzZm55aHQ1OFdZeUM3dDhteGNINA?oc=5) |
| CyberSecurityNews | Critical Wordpress Plugin Vulnerability Allows Attackers to Gain Full Control Over Website | 2026-07-17 21:20 | [Source Link](https://news.google.com/rss/articles/CBMifEFVX3lxTE1nbGhrTGtBemY4YXhGdHBSQklvMFFKU1ZYTXkzMzBRT2VCQkNPejlWNGhYeHNNZXVaNDg4NEVfQUhIblg2aUJOSUVJRDRndHNDdEx1S3RudDVEWXFCLVFPZW5qM2RpaWtCM2hKOUZnSTlWcWdQcDNFbnUwZjnSAYIBQVVfeXFMT0ZUUGhQMGhiTmtLaXd6RVJfQnNYdkdmUHJDVGM0bGpuR09wTmdpdFV1MmdQSEFZS0M1UWcwOGY1LXRfcC1NR3FZeWpib0luR3BieFlsWnBTWFlpak1lRU5oQTI2c2VVZmxzd2RyY2JOTm9mLWpJR3c1QjBGejEwX3dRZw?oc=5) |
| Rapid7 | CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core | 2026-07-17 21:20 | [Source Link](https://news.google.com/rss/articles/CBMixAFBVV95cUxPT3F0U1dMcGNIZHk0Q2wtalFYRzlqT0RWWlVWOGYxWFVCcHFueTNaR2gyNm1EMWRFQm9hVTdzZ0llSV9ZaVF0d3ZpNFhwdXNCbExqd2F0d1c3N0prZzVmQnBtcGZvV2szSGhyRnpwZm9CczFXaXUwcmtNR1ZCVWl2ZXlDZWVpTXhOVXdERVEwdHpMXzBnNjM3QTdBelM0dkJUQVBBV0JKTFFfZzhtNmppSXNrNGVsV2QyNnBPU2JGMy1hcFg2?oc=5) |
| Aikido Security | Unauthenticated RCE Vulnerability in WordPress core (wp2shell), via SQL injection. Patch the vulnerability now! | 2026-07-17 21:20 | [Source Link](https://news.google.com/rss/articles/CBMieEFVX3lxTE9mNVhUTFY4dGxoVW5WcFZ1NFpTNndBVHVINDR0Q3E2aEdGYXVCb0lWWlJiT0JXZU5qYnVIc0pBeXJyR0FzN3BsUl85b09Sc2JUMW5JeWY1UFdRWVFxZDZLNExHaU0yTkNpY2lFZG0td0RkVGJpdkM0aA?oc=5) |
| The Cloudflare Blog | Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities | 2026-07-17 21:20 | [Source Link](https://news.google.com/rss/articles/CBMiZEFVX3lxTE1IeDl5Qms5aXNaa1UzbnJmekloTG1xV21JVF9BZGNXZnNPNHdSdlFQNHF0YnRjT2FDc0F3QVYyWmxkc200eEZnQU9oUmVQQ2o0UWxONFV4bWJjR0xPT0xVME5wNC0?oc=5) |
| The Hacker News | New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code | 2026-07-17 21:20 | [Source Link](https://news.google.com/rss/articles/CBMiggFBVV95cUxQMXFtbXk5VE1CSFhHSGRQaVNZbUk5WnhUTFBVZk5VQmhZeVlWdzYtX1dlTUF0VHVwVXhtY0ZFY0NkanRIc0I0UFQ0VERzXzJRdzBJUE1odFdhVVpLS2pqeDN3X2tGbXh4TVNEbm1SNmNIQVZLZG51endOaDczVjNKc01B?oc=5) |

---
*Canonical Source: https://www.newsylist.com/trend/2026-07-18/new-wp2shell-wordpress-core-flaw-lets-unauthenticated-attackers-run-code*
*Synthesized by Newsylist Open Intelligence Engine under E-E-A-T journalistic standards.*