WordPress wp2shell Exploit: How Two Bugs Chain Into RCE

WordPress wp2shell exploit explained: how CVE-2026-63030 and CVE-2026-60137 chain into a pre-authentication RCE, and exactly what to do right now. On July 17, 2026, security researcher Adam Kues at Searchlight Cyber disclosed wp2shell, a pre-authentication remote code execution flaw in WordPress core affecting versions 6.9 and 7.0. Neither the REST API batch-route confusion (CVE-2026-63030) nor the WP_Query SQL injection (CVE-2026-60137) reaches critical severity alone, yet Wordfence scored the chained attack at CVSS 9.8. WordPress powers roughly 43 percent of all websites globally (W3Techs), and a working proof of concept became public within 24 hours of the patch. This video breaks down the full vulnerability chain, the open-source patch paradox, and the exact steps to verify your sites are protected. In this video: - How the REST API batch-route confusion desynchronizes WordPress's internal arrays to bypass authentication - How the SQL injection in WP_Query's author__not_in parameter is unlocked by the route confusion - Why chained CVSS scores multiply rather than add, and what that means for risk assessment - The open-source patch paradox: how fixing wp2shell simultaneously published the attack map - How to verify the patch landed (versions 7.0.2 or 6.9.5) and what WAF rules block both vulnerable paths Subscribe to Webronaq for clear, practical lessons on computer science, AI, and software engineering: https://www.youtube.com/@Webronaq #WordPresswp2shellexploit #CVE202663030 #WordPressRCE #WebSecurity #CyberSecurityExplained