MEDIUMVulnerability
Global

WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)

·Source: SANS ISC

Updated:

Executive Summary

Last week, Searchlight Cyber released details about a vulnerability they are calling "wp2shell". The vulnerability was initially announced without a CVE number. But now has been assigned CVE-2026-63030. Many WordPress plugin vulnerabilities are never assigned CVE numbers. But wp2shell is different. It is a SQL injection vulnerability in WordPress Core, not a plugin, and can lead to unauthenticated

Analysis

Last week, Searchlight Cyber released details about a vulnerability they are calling "wp2shell". The vulnerability was initially announced without a CVE number. But now has been assigned CVE-2026-63030. Many WordPress plugin vulnerabilities are never assigned CVE numbers. But wp2shell is different. It is a SQL injection vulnerability in WordPress Core, not a plugin, and can lead to unauthenticated remote code execution. Shortly after being announced, the vulnerability started to be exploited.

Indicators of Compromise (1)

CVE (1)
CVE-2026-63030
NVDMITRE CVE
Source Attribution

Originally published by SANS ISC on Jul 20, 2026.

Related Threats

MEDIUMVulnerabilityNEW

French Parliament greenlights social media ban for under-15s

Both houses of the French Parliament voted to block social media access for children under 15, making France the first European country to enact a ban amid a broadening global crackdown.

The Record
MEDIUMVulnerability

Rondo Meets Geoserver, (Wed, Jul 22nd)

This isn&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;t a new attack, but something I saw "pop-up" in our logs this week:

SANS ISC
MEDIUMVulnerability

Pixels Tracking Every Loan You Take on EU Bank Websites

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/pixels-tracking-every-loan-you-take-on-eu-bank-websites-image_small-2-a-32296.jpg" align=right hspace=4><b>Jscrambler Detects Cookies Exporting Detailed View of Customer Financial Intent</b><br>Many European and American bank websites are quietly - and perhaps unwittingly - sending sensitive customer data to third parties such as

Bank Info Security