The WordPress core vulnerability chain known as wp2shell, tracked as CVE-2026-63030 and CVE-2026-60137, combined two relatively ordinary programming mistakes into an unauthenticated remote code execution chain. The first mistake caused requests within the WordPress REST…