FlagThis - Latest Cybersecurity News

WordPress Core is affected by a critical RCE chain dubbed "wp2shell," combining CVE-2026-60137 (SQL injection in WP_Query's author__not_in parameter) and CVE-2026-63030 (REST API batch-route confusion). Unauthenticated remote attackers can exploit the /wp-json/batch/v1 endpoint to bypass security controls and execute arbitrary code without user interaction or plugin dependencies. The vulnerability is exacerbated in environments lacking persistent object caching. Immediate remediation requires updating to versions 6.9.5, 7.0.2, or 7.1 Beta 2. Active exploitation is confirmed, with AI-assisted tools accelerating PoC development and patch diffing.