Critical SQL Injection (CVE‑2026‑63030) in WordPress Core Enables Unauthenticated RCE
What It Is – A newly‑assigned CVE (CVE‑2026‑63030) describes a SQL‑injection flaw in the WordPress core codebase, dubbed “wp2shell”. The flaw allows an attacker to inject arbitrary SQL, which can be chained to remote code execution without any credentials.
Exploitability – Public proof‑of‑concept code appeared within days of the advisory; active exploitation is already observed in the wild. The CVSS score is 9.8 (Critical).
Affected Products – WordPress 5.9 and later (core). All sites running the vulnerable core, regardless of plugins or hosting environment.
Why It Matters for Compliance & Audit Readiness
- Control Mapping – SOC 2 requires documented change‑management and vulnerability‑remediation processes; this exploit highlights gaps in timely patching of core software.
- Continuous Evidence – Demonstrating that core updates are applied within defined windows provides audit‑ready evidence of due diligence.
- Enterprise Buyer Expectations – Large customers now demand proof that SaaS providers maintain an up‑to‑date CMS stack as part of their security posture.
Recommended Actions
- Deploy the official WordPress security release that patches CVE‑2026‑63030 immediately.
- Verify that all web‑server components (PHP, MySQL, web server) are also patched and that no legacy plugins re‑introduce the flaw.
- Update your SOC 2 control map to include automated monitoring of WordPress core versions and retain evidence of each update cycle.
Source: SANS Internet Storm Center – WordPress Exploitation Underway (CVE‑2026‑63030)