WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)

Searchlight Cyber disclosed a critical WordPress Core SQL injection vulnerability dubbed "wp2shell" (CVE-2026-63030) that allows unauthenticated RCE via the REST API and has been observed exploited in the wild; published exploit requests demonstrate a UNION-based SQLi that writes a PHP webshell to /var/www/wp-content/cache/94uh9ubh6e1x.php and attackers subsequently added admin users. The report includes decoded queries, raw exploit payloads captured by honeypots, and quick remediation/detection advice (check the cache directory and recently created users).