Originally published at: Patch now: WordPress Core “wp2shell” chain (CVE-2026-60137, CVE-2026-63030) - ToolsLib Blog
Two WordPress Core bugs—CVE-2026-60137 and CVE-2026-63030—can be chained for pre-auth RCE on specific versions. Public PoCs exist. Update to 7.0.2 or 6.9.5 now.