New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

A critical security flaw identified as wp2shell has been discovered within the WordPress Core. This vulnerability, cataloged as CVE-2026-63030, is a remote code execution (RCE) flaw that enables unauthenticated attackers to run code on affected systems. According to Aikido Security, the vulnerability is facilitated via SQL injection. The flaw is described as pre-authentication, meaning that an attacker does not need valid login credentials to execute the exploit and potentially gain full control over the targeted website. Major security outlets and service providers are actively reporting on the risk and their corresponding defenses. The Hacker News and cyberkendra.com have highlighted that the flaw lets anyone run code, while Rapid7 specifically identifies the vulnerability by its CVE-2026-63030 designation.

Security Boulevard provides analysis on the issue, framing wp2shell as an exposure validation problem. Meanwhile, CyberSecurityNews reports that the vulnerability allows attackers to gain complete control over the impacted websites, stressing the severity of the exploit. Contextually, this vulnerability represents a high-severity risk due to its location in the core software rather than a third-party plugin, although CyberSecurityNews mentions a plugin vulnerability in its reporting. The urgency of the situation is underscored by Aikido Security, which has issued a direct call for users to patch the vulnerability immediately. The scale of the threat has prompted several cloud and security infrastructure providers to implement protective measures to shield WordPress applications from the exploit before users can apply manual patches. Immediate attention is being directed toward runtime protection and web application firewall (WAF) updates.

The Cloudflare Blog reports that the Cloudflare WAF is protecting WordPress applications from two high-severity vulnerabilities, including this one. Imperva has stated that its customers are protected against the wp2shell pre-authentication RCE. Additionally, TipRanks notes that Aikido Security is utilizing this vulnerability to position its runtime protection offerings. Users are advised to monitor for official patches and maintain their WAF configurations to mitigate the risk of unauthorized code execution.