EXPLOIT/ALERT Back to feed

WordPress Core SQL Injection Vulnerability

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.

Published 26 Aug 2026Updated 26 Aug 2026146 sources
CVSS 0.0 PoC CANDIDATE△ CISA KEV
Overview Sources History

What happened

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.

Affected versions

Core: See original advisory Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

  • Review the original advisory and validate affected versions.
  • Apply vendor-provided updates or mitigations when available.

Public PoC references

RepositoryAuthorFirst seenReference
CVE-Intel · Icex0/wp2shell-pocwp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chainRCEPython★ 757⑂ 172Code indexedUpdated 26 Aug 2026Tags: cve-2026-63030, wp2shell, wp2shell-pocIcex02026-07-17CandidateCVE-Intel · sowarma/wp2shell-PoCCVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-conceptRCEPython★ 914⑂ 215Code indexedUpdated 25 Aug 2026Tags: cve, cve-2026-60137, cve-2026-63030, data-analysis, wp2shell, wp2shell-pocsowarma2026-08-05CandidateCVE-Intel · dinosn/wp2shell-labNon-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1InjectionPython★ 59⑂ 21Code indexedUpdated 25 Aug 2026Tags: cve-2026-60137, cve-2026-63030, security, sql-injection, vulnerability-lab, wordpress, wp2shelldinosn2026-07-18CandidateCVE-Intel · ZephrFish/wp2shell-scannerCVE-2026-63030, CVE-2026-60137, wp2shell scannerExploitPython★ 55⑂ 11Code indexedUpdated 23 Aug 2026ZephrFish2026-07-17CandidateCVE-Intel · DeadExpl0it/wp2shell-pocwp2shell — WordPress Core Pre-Auth RCE Chain poc for CVE-2026-63030 and CVE-2026-60137RCEPython★ 0⑂ 0Code indexedUpdated 21 Aug 2026DeadExpl0it2026-08-21CandidateCVE-Intel · mhassani97/cve-2026-63030-labwp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chainRCEDockerfile★ 0⑂ 1Code indexedUpdated 20 Aug 2026mhassani972026-08-20CandidateCVE-Intel · TranDongA3/POC-CVE-2026-63030-CVE-2026-60137-PoC★ 0⑂ 0Updated 19 Aug 2026TranDongA32026-08-19CandidateCVE-Intel · 0xsha/wp2shellCVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress coreRCEPython★ 102⑂ 29Code indexedUpdated 18 Aug 20260xsha2026-07-18Candidate
CorrectionsReport an issue