{"id":241248,"date":"2026-07-21T05:18:11","date_gmt":"2026-07-21T10:18:11","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/07\/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now"},"modified":"2026-07-21T05:18:11","modified_gmt":"2026-07-21T10:18:11","slug":"wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/07\/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now","title":{"rendered":"WordPress Core \u201cwp2shell\u201d RCE flaws get public exploits, patch now"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now.jpg\"><\/a><\/p>\n<p>Public exploits have been released for the critical \u201cwp2shell\u201d remote code execution vulnerabilities affecting WordPress Core, making it imperative that administrators patch their sites immediately.<\/p>\n<p>The wp2shell attack consists of two flaws, tracked as CVE-2026\u201363030 and CVE-2026\u201360137, that can be chained together to achieve pre-authentication remote code execution against WordPress installs running versions 6.9.x and 7.0.x.<\/p>\n<p>The flaws were discovered by Adam Kues of Searchlight Cyber, which says an unauthenticated attacker can exploit them against a default WordPress installation.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Public exploits have been released for the critical \u201cwp2shell\u201d remote code execution vulnerabilities affecting WordPress Core, making it imperative that administrators patch their sites immediately. The wp2shell attack consists of two flaws, tracked as CVE-2026\u201363030 and CVE-2026\u201360137, that can be chained together to achieve pre-authentication remote code execution against WordPress installs running versions 6.9.x and [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1492],"tags":[],"class_list":["post-241248","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/241248","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=241248"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/241248\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=241248"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=241248"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=241248"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}