
wp2shell-checker
WordPress Core Unauthenticated RCE (CVE-2026-63030, CVE-2026-60137)
exploitationnetwork-securitypenetration-testing-frameworks+2
1

WordPress Core Unauthenticated RCE (CVE-2026-63030, CVE-2026-60137)

WordPress wp2shell pre-auth RCE exploit kit (CVE-2026-63030 + CVE-2026-60137)

Caches JWT authentication tokens from an auth URL and attaches them as headers to in-scope requests in Burp Suite for automated session handling.