FlagThis - Latest Cybersecurity News

A critical exploit chain dubbed "WP2Shell" enables unauthenticated remote code execution (RCE) in WordPress Core by chaining a REST API batch-route confusion vulnerability (CVE-2026-63030) with a SQL injection in the WP_Query author__not_in parameter (CVE-2026-60137). Attackers leverage the /wp-json/batch/v1 endpoint to bypass security controls and trigger the SQLi vector, achieving RCE on default installations lacking a persistent object cache. Immediate remediation requires updating to WordPress versions 6.9.5 or 7.0.2+.

WordPress Core is affected by a critical RCE chain dubbed "wp2shell," combining CVE-2026-60137 (SQL injection in WP_Query's author__not_in parameter) and CVE-2026-63030 (REST API batch-route confusion). Unauthenticated remote attackers can exploit the /wp-json/batch/v1 endpoint to bypass security controls and execute arbitrary code without user interaction or plugin dependencies. The vulnerability is exacerbated in environments lacking persistent object caching. Immediate remediation requires updating to versions 6.9.5, 7.0.2, or 7.1 Beta 2. Active exploitation is confirmed, with AI-assisted tools accelerating PoC development and patch diffing.

CVE-2026-3300 is a critical insecure deserialization vulnerability in Everest Forms Pro that enables unauthenticated remote code execution (RCE). The flaw originates from the plugin passing unsanitized user-supplied serialized strings to the PHP unserialize() function, facilitating PHP Object Injection. Attackers can leverage gadget chains to trigger sinks like call_user_func() and file_put_contents(), allowing the deployment of web shells and full server compromise. Immediate patching is required to prevent unauthorized system takeover and subsequent lateral movement within the hosting environment.

CVE-2026-8713 is a critical arbitrary file deletion vulnerability affecting the Avada Builder (Fusion Builder) WordPress plugin. The flaw enables unauthenticated remote attackers to delete arbitrary files on the host server by exploiting improper input validation and missing authorization checks within the plugin's file-handling functions. This vulnerability poses a severe risk of widespread Denial of Service (DoS) or the removal of critical security configuration files, potentially facilitating further system compromise. Given an estimated install base exceeding one million websites, immediate patching is required to mitigate the risk of large-scale exploitation.