Inside wp2shell: How Two WordPress Core Bugs Became a Critical RCE Chain

This report describes a multi-stage attack abusing CVE-2026-63030 in WordPress: an authorization bypass in the REST API permits triggering an SQL injection through the author__not_in parameter, enabling exfiltration of database records (user credentials, password hashes, API keys, configuration) and escalation to administrative access, after which attackers can achieve remote code execution via standard WordPress administrative features.