An exploit has been published for the RCE chain in WordPress

Security researchers have published wp2shell-PoC, demonstrating the possibility of remote code execution (RCE) in the WordPress content management system. The vulnerability exploits a chain of two critical bugs: CVE-2026-63030 and CVE-2026-60137.

The attack mechanism is based on a combination of route confusion and SQL injection. This combination allows an attacker to gain access to the system without prior authentication. The tool provides functionality for checking the vulnerability of the target resource, reading data from the database, and directly executing arbitrary commands on the server.

At the moment, the PoC is available in an open repository on GitHub. The use of such tools is limited to the framework of penetration testing and security auditing of own systems. Developers are recommended to check the relevance of WordPress versions and the presence of patches that close the specified vulnerability identifiers.

The detection of such chains highlights the risks associated with routing errors in popular CMS. The ability to execute code without authorization is a critical attack vector that requires immediate infrastructure updates to prevent unauthorized access to data.