
wp2shell (CVE-2026-63030): A WordPress Core Pre-Auth RCE, and What to Do Now
wp2shell (CVE-2026-63030 + CVE-2026-60137) is a pre-authentication RCE in WordPress Core, already exploited in the wild. Here's who is affected, how the exploit chain works, how to patch, and how to check whether your server was already compromised.








