# New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

> **Open Intelligence Dossier** · First detected: 2026-07-18 04:07 UTC · Category: Technology

## Executive Summary
A critical pre-authentication remote code execution vulnerability known as wp2shell allows unauthenticated attackers to run code in WordPress Core.

## Intelligence Brief
A critical security flaw identified as wp2shell has been discovered within the WordPress Core. This vulnerability, cataloged as CVE-2026-63030, is a remote code execution (RCE) flaw that enables unauthenticated attackers to run code on affected systems. According to Aikido Security, the vulnerability is facilitated via SQL injection. The flaw is described as pre-authentication, meaning that an attacker does not need valid login credentials to execute the exploit and potentially gain full control over the targeted website. Major security outlets and service providers are actively reporting on the risk and their corresponding defenses. The Hacker News and cyberkendra.com have highlighted that the flaw lets anyone run code, while Rapid7 specifically identifies the vulnerability by its CVE-2026-63030 designation.


Security Boulevard provides analysis on the issue, framing wp2shell as an exposure validation problem. Meanwhile, CyberSecurityNews reports that the vulnerability allows attackers to gain complete control over the impacted websites, stressing the severity of the exploit. Contextually, this vulnerability represents a high-severity risk due to its location in the core software rather than a third-party plugin, although CyberSecurityNews mentions a plugin vulnerability in its reporting. The urgency of the situation is underscored by Aikido Security, which has issued a direct call for users to patch the vulnerability immediately. The scale of the threat has prompted several cloud and security infrastructure providers to implement protective measures to shield WordPress applications from the exploit before users can apply manual patches. Immediate attention is being directed toward runtime protection and web application firewall (WAF) updates.


The Cloudflare Blog reports that the Cloudflare WAF is protecting WordPress applications from two high-severity vulnerabilities, including this one. Imperva has stated that its customers are protected against the wp2shell pre-authentication RCE. Additionally, TipRanks notes that Aikido Security is utilizing this vulnerability to position its runtime protection offerings. Users are advised to monitor for official patches and maintain their WAF configurations to mitigate the risk of unauthorized code execution.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| Security Boulevard | Imperva Customers Protected Against “wp2shell” Pre-Authentication RCE in WordPress Core | [Source Link](https://news.google.com/rss/articles/CBMiwgFBVV95cUxNUkgxeklkSWFobzllUVZMN3ZrcEt5Z2oxaHJZS0l2amdnbG9wTEFPVm9LYzNNMUx5eVlQS3g1Q0FXQUhTamxaOEdPRlpkaVdoUGJYQ1pQcHJ3bF9XUTg4Zy01eXN2WnFZWUp3TE9MbjNGM1lPV0VOS1lYdWJSblpVbmhTdHhnRWs3S29iaGMzX3k2REdBR2pXWTBUUjJaTng3akJ5Qks2N3F2dWRPR3A4VUFlY2NnS2Y4bVRLcW9HTUhpQQ?oc=5) |
| Security Boulevard | wp2shell: A Pre-Authentication RCE in WordPress Core, and Why It Is an Exposure Validation Problem | [Source Link](https://news.google.com/rss/articles/CBMi0AFBVV95cUxQXzBMc2g1OFdoSmotcm9mc1VjdmgzeGlSYXBNVHVrQXRFUVV5bzlQeF9RcVJDeE9pN19ycW0tN0FZYVNCRVF3UUdqY0FxYkNTbFJCaXNHQUZIdnhBTk9PUmdnRjFuVWo1cFI4ZXVnMUZNc3dXUk41UnJ0NXpHR2M1NnhQVDRGMzlVVmNNUFhHa0VBRFYzb3NEZnpmX2VtZ1M1eVpCbnBzTnB5djI3UXFzZElMUDJNNndtbnlPeXNpTGdWb1BCY2xnaV9aZWJJdVl4?oc=5) |
| TipRanks | Aikido Security Highlights WordPress Vulnerability and Positions Runtime Protection Offering | [Source Link](https://news.google.com/rss/articles/CBMi1wFBVV95cUxPNVg5cGNDVW9tU05tMThuMlY0blZFSlhNM05WdElVWUdYVFdXZG9pSUJaUGxDejF6UmU3RGpQT1h4bVRra2JlRXYza1U4aXNYR01yM3NVZ0RhQTdLdkpNQ0N4Qm0wcC1BeG1JTUx6NFhFV21HVDFfQ2FVMWp1TWdwM3RUVF9EU1FlTGJseHB3dTFfZDJVMi1NbWVMX0tmQWtQbXNCX29lel9EOTEweTdON0h2NWN3SGctNDNNSHROZTZ1aDAzZm55aHQ1OFdZeUM3dDhteGNINA?oc=5) |
| cyberkendra.com | WP2Shell: Critical WordPress Flaw Lets Anyone Run Code | [Source Link](https://news.google.com/rss/articles/CBMihAFBVV95cUxNM0ZPM0RVZmdYdTZfQlVQUFhoU2d0MFY5Yjg1dlYzZko3cTBtOHJvTXFaS0lmTVI4VUNfV2tmVmdwNl83MkZfSkNmSzM0V24wUFRBdlNONnBfT2VzM1huZGQxR3AtUHRiU2M3VDlGUE5uWXMybDVaQWpjazYtVHkwdERFM0w?oc=5) |
| CyberSecurityNews | Critical Wordpress Plugin Vulnerability Allows Attackers to Gain Full Control Over Website | [Source Link](https://news.google.com/rss/articles/CBMifEFVX3lxTE1nbGhrTGtBemY4YXhGdHBSQklvMFFKU1ZYTXkzMzBRT2VCQkNPejlWNGhYeHNNZXVaNDg4NEVfQUhIblg2aUJOSUVJRDRndHNDdEx1S3RudDVEWXFCLVFPZW5qM2RpaWtCM2hKOUZnSTlWcWdQcDNFbnUwZjnSAYIBQVVfeXFMT0ZUUGhQMGhiTmtLaXd6RVJfQnNYdkdmUHJDVGM0bGpuR09wTmdpdFV1MmdQSEFZS0M1UWcwOGY1LXRfcC1NR3FZeWpib0luR3BieFlsWnBTWFlpak1lRU5oQTI2c2VVZmxzd2RyY2JOTm9mLWpJR3c1QjBGejEwX3dRZw?oc=5) |
| Rapid7 | CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core | [Source Link](https://news.google.com/rss/articles/CBMixAFBVV95cUxPT3F0U1dMcGNIZHk0Q2wtalFYRzlqT0RWWlVWOGYxWFVCcHFueTNaR2gyNm1EMWRFQm9hVTdzZ0llSV9ZaVF0d3ZpNFhwdXNCbExqd2F0d1c3N0prZzVmQnBtcGZvV2szSGhyRnpwZm9CczFXaXUwcmtNR1ZCVWl2ZXlDZWVpTXhOVXdERVEwdHpMXzBnNjM3QTdBelM0dkJUQVBBV0JKTFFfZzhtNmppSXNrNGVsV2QyNnBPU2JGMy1hcFg2?oc=5) |
| Aikido Security | Unauthenticated RCE Vulnerability in WordPress core (wp2shell), via SQL injection. Patch the vulnerability now! | [Source Link](https://news.google.com/rss/articles/CBMieEFVX3lxTE9mNVhUTFY4dGxoVW5WcFZ1NFpTNndBVHVINDR0Q3E2aEdGYXVCb0lWWlJiT0JXZU5qYnVIc0pBeXJyR0FzN3BsUl85b09Sc2JUMW5JeWY1UFdRWVFxZDZLNExHaU0yTkNpY2lFZG0td0RkVGJpdkM0aA?oc=5) |
| The Cloudflare Blog | Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities | [Source Link](https://news.google.com/rss/articles/CBMiZEFVX3lxTE1IeDl5Qms5aXNaa1UzbnJmekloTG1xV21JVF9BZGNXZnNPNHdSdlFQNHF0YnRjT2FDc0F3QVYyWmxkc200eEZnQU9oUmVQQ2o0UWxONFV4bWJjR0xPT0xVME5wNC0?oc=5) |
| The Hacker News | New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code | [Source Link](https://news.google.com/rss/articles/CBMiggFBVV95cUxQMXFtbXk5VE1CSFhHSGRQaVNZbUk5WnhUTFBVZk5VQmhZeVlWdzYtX1dlTUF0VHVwVXhtY0ZFY0NkanRIc0I0UFQ0VERzXzJRdzBJUE1odFdhVVpLS2pqeDN3X2tGbXh4TVNEbm1SNmNIQVZLZG51endOaDczVjNKc01B?oc=5) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-07-18/new-wp2shell-wordpress-core-flaw-lets-unauthenticated-attackers-run-code*