{"uuid": "4372541d-aca3-4209-9e01-b792fe1cefe5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://infosec.exchange/ap/users/116810780845358081/statuses/116939389643192070", "content": "\ud83d\udea8 CRITICAL: WordPress Core \"wp2shell\" RCE\nA single anonymous HTTP request can lead to Remote Code Execution on vulnerable WordPress Core installations.\n\u26a0\ufe0f No plugins.\u26a0\ufe0f No themes.\u26a0\ufe0f No authentication required.\nTracked as:\ud83d\udd34 CVE-2026-63030 (REST API Batch Route Confusion \u2192 RCE)\ud83d\udd34 CVE-2026-60137 (Facilitated SQL Injection)\nAffected versions\u2022 WordPress 6.9.0\u20136.9.4\u2022 WordPress 7.0.0\u20137.0.1\n\u2705 Update immediately to WordPress 6.9.5 or 7.0.2. Due to the severity, WordPress has enabled forced automatic security updates for affected installations.\n\ud83d\udd17 Full technical analysis:https://thecybersecguru.com/news/wordpress-core-rce-wp2shell/\n#WordPress #WordPressSecurity #wp2shell #CVE202663030 #CVE202660137 #RCE #RemoteCodeExecution #SQLInjection #RESTAPI #CyberSecurity #InfoSec #WebSecurity #WebsiteSecurity #PatchNow #ThreatIntelligence #BlueTeam #SOC #Linux #PHP #ZeroDay #SecurityResearch #SysAdmin #DevSecOps", "creation_timestamp": "2026-07-18T06:11:07.796792Z"}