Critical WordPress Core “wp2shell” RCE Flaws (CVE‑2026‑63030, CVE‑2026‑60137) Exposed via Public Exploits
What Happened — Public proof‑of‑concept exploits were released for two newly disclosed WordPress Core vulnerabilities (CVE‑2026‑63030 and CVE‑2026‑60137). The flaws can be chained to achieve pre‑authentication remote code execution on default installations of WordPress 6.9.x and 7.0.x. WordPress has issued forced automatic updates to 6.9.5 and 7.0.2.
Why It Matters for Compliance & Audit Readiness
- The scenario illustrates a classic control‑gap: lack of timely patch management and evidence of remediation, a core SOC 2 CC6.1 (Change Management) requirement.
- Continuous evidence collection (e.g., automated update logs, configuration baselines) provides the audit‑ready proof that your organization is actively mitigating known vulnerabilities.
- Mapping this vulnerability to your control framework helps demonstrate due diligence during a SOC 2 audit and reduces the risk of a breach that would trigger incident‑response controls (CC7.1).
Who Is Affected — All organizations that host public‑facing WordPress sites, spanning media, e‑commerce, education, SaaS, and government portals.
Recommended Actions
- Verify that all WordPress installations are running 6.9.5 or 7.0.2 (or later).
- Enable and monitor forced automatic updates; retain logs as audit evidence.
- Incorporate vulnerability scanning into your continuous compliance pipeline and map findings to SOC 2 change‑management controls.
- Document remediation steps in your control repository for future audit reviews.
Source: BleepingComputer
Technical Notes
- Attack vector: Exploitation of a REST‑API batch‑route confusion (CVE‑2026‑63030) combined with an SQL‑injection in
author__not_in(CVE‑2026‑60137). - Impact: Pre‑authentication remote code execution on default WordPress installs; no plugins required.
- CVSS: Not officially published yet, but the vendor rates both as critical.
Source: WordPress security advisory, GitHub advisory