Critical wp2shell Vulnerability Hits WordPress Core, Patch Released

WordPress patched a critical RCE vulnerability dubbed "wp2shell" (CVE-2026-63030) that allowed anonymous remote code execution via the REST API batch endpoint and also fixed a separate critical SQL injection (CVE-2026-60137); affected versions were updated in WordPress 6.9.5 and 7.0.2, forced auto-updates were enabled for vulnerable releases, and administrators are urged to apply patches or temporarily block the batch endpoints at the WAF level because exploitation requires no authentication and could impact a large proportion of internet sites.