Version 1.1: WordPress - Schwachstellen erlauben Remote Code Execution

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-07-20 12:05 UTC
Importiert: 2026-10-21 10:27 UTC
CVSS: 9.8
Quelle-ID: bsi_csw
uid_hash: d1b64fd223c3d5c66902abfc40f9da9408a562ed4273925bea1377d3082e502d

BSI CSW

Inhalt

BSI - Bundesamt für Sicherheit in der Informationstechnik - Version 1.1: WordPress - Schwachstellen erlauben Remote Code Execution

  Navigation und Service
  
    
      Springe direkt zu:
   
    
      Inhalt
      Hauptmenü
      Suche
   
 

    
      Menü
      
        Menü
          
       
     
   

  
    
      
        
          Servicemenü
          Servicemenue

  
        
    Kontakt

    
        














































English






    
        
    Gebärdensprache

    
        
    Leichte Sprache

    
        
    Nutzungsbedingungen

    
        














    Login



    

        
     
      
        
          
           
              
  


            
         
            
             
                
                
                
              
           
        
     
      
       
          
  


        
     
      
        
          Hauptmenü
          

          
      Das BSI
  
        
        
        
        
          Das BSI
        
          
                
      Cybernation Deutschland
  
            
                
      Auftrag
  
            
                
      Organisation und Aufbau
  
            
                
      Leitbild
  
            
                
      Zeitstrahl
  
            
                
      BSI Standorte
  
            
                
      Umwelterklärung
  
            
      
    
  
          
      Themen
  
        
        
        
        
          Alle Themen
        
          
                
      Staat und Verwaltung
  
                  Unsere Top-Themen
                  
                    
                        
      Nationales IT-Lagezentrum
  
                    
                        
      CERT-Bund
  
                    
                        
      Zusammenarbeit mit Bund und Ländern
  
                    
                        
      Sicherheitsberatung
  
                    
                        
      Mindeststandards Bund
  
                    
                  Alle Themen
                
              
            
                
      Unternehmen und Organisationen
  
                  Unsere Top-Themen
                  
                    
                        
      Cyber Resilience Act
  
                    
                        
      Grundschutz in der Informationssicherheit
  
                    
                        
      Threat Intelligence
  
                    
                        
      IT-Sicherheitskennzeichen
  
                    
                        
      Zertifzierung, Kennzeichnung und Anerkennung
  
                    
                  Alle Themen
                
              
            
                
      Verbraucherinnen und Verbraucher
  
                  Unsere Top-Themen
                  
                    
                        
      Sicherheit beim Onlineshopping
  
                    
                        
      Online-Account absichern
  
                    
                        
      Bedrohungen durch Cyber-Kriminelle
  
                    
                        
      E-Mail, Social Media, Messenger und Co.
  
                    
                        
      Smart Metering &amp; Ladeinfrastruktur
  
                    
                  Alle Themen
                
              
            
                
      Regulierte Wirtschaft
  
                  Unsere Top-Themen
                  
                    
                        
      NIS-2-regulierte Unternehmen
  
                    
                        
      Kritische Infrastrukturen (KRITIS)
  
                    
                        
      KRITIS-FAQ
  
                    
                  Alle Themen
                
              
            
      
    
  
          
      IT-Sicherheitsvorfall
  
        
        
        
        
          IT-Sicherheitsvorfall
        
          
                
      Verbraucherinnen und Verbraucher
  
            
                
      Unternehmen
  
            
                
      Kritische Infrastrukturen und meldepflichtige Unternehmen
  
            
                
      CVD-Richtlinie des BSI
  
            
      
    
  
          
      Karriere
  
        
        
        
        
          Karriere
        
          
                
      Willkommen im #TeamBSI
  
            
                
      Warum BSI?
  
            
                
      Arbeiten im BSI
  
            
                
      Einstieg
  
            
                
      FAQ
  
            
                
      Stellenangebote
  
            
                
      Termine
  
            
                
      Kontakt Personalgewinnung
  
            
      
    
  
          
      Service
  
        
        
        
        
          Service
        
          
                
      Presse
  
            
                


























Mediathek






            
                
      Publikationen
  
            
                
      Newsletter und Social Media
  
            
                
      Veranstaltungen
  
            
                
      Vergaben an Externe
  
            
                
      Die E-Rechnung im BSI
  
            
                
      Kosten für Leistungen des BSI
  
            
                
      Kontakt
  
            
                
      Fragen &amp; Antworten
  
            
      
    
  
          


  BSI-Portal


        
        
        
        
          &lt;abbr title=&#034;Bundesamt für Sicherheit in der Informationstechnik&#034;&gt;BSI&lt;/abbr&gt;-Portal
        
          
      
    
  
    
      
      
      SucheOeffnen

Suche

Suche 



          
          
          


        
            



        
          Häufig gesucht
        
          
                
                  
                    Regulierung nach NIS-2 
                
              
            
                
                  
                    Gefährdungen durch Ransomware
                
              
            
                
                  
                    Zertifizierung Produkte &amp; Personen (FAQ)
                
              
            
                
                  
                    Zertifizierung Common Criteria
                
              
            
                
                  
                    Elektronische Identitäten
                
              
            
                
                  
                    Digitaler Verbraucherschutz
                
              
            
                
                  
                    Technische Richtlinien
                
              
            
                
                  
                    Kritische Infrastrukturen
                
              
            
                
                  
                    Künstliche Intelligenz
                
              
            
      
    
      
        
        
    
  





  
  
    
      
        
          Sie sind hier:
          



  
  Zur Startseite

Version 1.1: WordPress - Schwachstellen erlauben Remote Code Execution

Kritikalität 3

BeschreibungAm 17.07.2026 wurde seitens WordPress eine Aktualisierung bekannt gegeben [WP26], welche zwei Schwachstellen in der WordPress-Software behebt. WordPress ist ein weit verbreitetes Content Management System (CMS), insbesondere bei Blog-Betreibern und Webshops. Die beiden nun bekannt gewordenen Schwachstellen CVE-2026-60137 und CVE-2026-63030 ermöglichen in Kombination einem nicht-authentifizierten, entfernten Angreifer Code zur Ausführung zu bringen ("Remote Code Execution") und wurden auch als "wp2shell" getauft,.

Update 1 (20.07.2026): Im Laufe des Wochenendes sind PoCs veröffentlicht worden, die eine Ausnutzung der vollständigen Schwachstellenkette und damit Angriffe ohne Authentifizierung ermöglichen. Berichte über erste Ausnutzungen existieren ebenfalls.

    Publikationen
        
          
                
                      Download Version 1.1: WordPress - Schwachstellen erlauben Remote Code Execution (PDF)
                  
            
      





  
  





  Fußbereich
   
    
      
        Seite drucken
     
   
 





  Unternavigation aller Website-Bereiche
      
      
      
        Themen
      
      
                

    Verbraucherinnen und Verbraucher

                

    Unternehmen und Organisationen

                

    Staat und Verwaltung

                

    Regulierte Wirtschaft

      
      
        Das BSI
      
      
                

    Leitbild

                

    Organisation und Aufbau

                

    BSI Standorte

                

    Auftrag

                

    Kontakt

      
                 

      
      
      
        Karriere
      
      
                

    Arbeiten im BSI

                

    Stellenangebote

                

    Studium und Ausbildung

      
                 

      
      
      
        IT-Sicherheitsvorfall
      
      
                

    IT-Sicherheitsvorfall

      
                 

  
    
      Folgen Sie uns
      
            
                
                  Das BSI auf Bluesky
                
            
            
                
                  BSI-Instagram
                
            
            
                
                  Das BSI auf LinkedIn
                
            
            
                
                  Das BSI auf Mastodon
                
            
            
                
                  Newsletterverwaltung
                
            
            
                
                  Das BSI auf YouTube
                
            
            
                
                  Das BSI auf Xing
                
            
            
                
                  RSS
                
            
      


    
  

    
    
      
        
          

      Impressum
                
          

      Datenschutz
                
          

      Nutzungsbedingungen
                
          

      Barrierefreiheit
                
       
     
      
       
          &#169; Bundesamt für Sicherheit in der Informationstechnik
        
     
   
 
  
    
      
       
          Top
          Top
       
     
   
 










  
    
      
        Hinweis zur Verwendung von Cookies
      
    
    
      Das BSI speichert keine personenbezogenen Daten der Webseitenbesucher. Details in unserer Datenschutzerklärung

    
    
      OK

Verknuepfte CVEs

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-60137	CRITICAL	9.8	CRITICAL	9.1	0.05323	0.92534	2026-07-17
CVE-2026-63030	CRITICAL	9.8	CRITICAL	9.8	0.10649	0.95769	2026-07-17

Externe Referenzen

Bezeichnung	Typ	CVE	Quelle
GitHub 0xCyp1337/CVE-2026-63030-CVE-2026-60137-WP2SHELL	POC	CVE-2026-60137	github_poc
GitHub 0xMarcio/pocindex: Search 82,000+ public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub.	POC	CVE-2026-60137	github_poc
GitHub 0xh7ml/CVE-2026-63030	POC	CVE-2026-60137	github_poc
GitHub 0xjessie21/wp2shell-checker: WordPress Core Unauthenticated RCE (CVE-2026-63030, CVE-2026-60137)	POC	CVE-2026-60137	github_poc
GitHub 0xsyr0/OSCP: OSCP Cheat Sheet	POC	CVE-2026-63030	github_poc
GitHub 1beelze/1beelze	POC	CVE-2026-63030	github_poc
GitHub 1dayexploit/1day-archive: Technical deep-dives and root cause analyses of recently disclosed CVEs - reverse engineering patches, building proof-of	POC	CVE-2026-63030	github_poc
GitHub 4B3R4M4-607D/CVE-2026-63030-POC: CVE-2026-63030 / wp2shell	POC	CVE-2026-60137	github_poc
GitHub AC-DAC/Mothership-Public: Mothership is a self-hosted, centralised management dashboard for over 15 WordPress client sites, built on MainWP and de	POC	CVE-2026-60137	github_poc
GitHub ARPSyndicate/cve-scores: EPSS & VEDAS Score Aggregator for CVEs	POC	CVE-2026-60137	github_poc
GitHub ASYquan/wp2shell-cf-WAF-bypass: wp2shell PoC with Cloudflare WAF bypass via body padding (CVE-2026-63030)	POC	CVE-2026-63030	github_poc
GitHub AbdullahMaqbool22/CVE-2026-60137-WordPress-Core-SQL-Injection-PoC: Non-destructive proof-of-concept and verification harness for CVE-2026-60137, a blind SQL injection in WordPress core (`	POC	CVE-2026-60137	github_poc
GitHub AdarshThakur14777-cyber/CVE-2026-60137: wpsqli full SQLi extractor + dumper for CVE-2026-60137	POC	CVE-2026-60137	github_poc
GitHub AdnaneKhan/Wp2Shell-RCE: PoC Repository with Lab Setup for Wp2Shell RCE	POC	CVE-2026-60137	github_poc
GitHub Adrees-Basheer/wp2shell-vulnerability-scanner: Scan WordPress installations for wp2shell vulnerabilities (CVE-2026-63030 + CVE-2026-60137). Identifies full RCE and SQL	POC	CVE-2026-60137	github_poc
GitHub AlditoMMX/DockerLabs-Writeup-Acme: Laboratorio/CTF autorizado de DockerLabs. Este writeup documenta únicamente la resolución de la máquina Acme.	POC	CVE-2026-63030	github_poc
GitHub AnggaTechI/CVE-2026-63030: WordPress Core Pre-Auth RCE — Batch Route Confusion + SQL Injection	POC	CVE-2026-60137	github_poc
GitHub BIBILZERODAY/CVE-2026-60137---WordPress-Core-Critical-SQL-Injection-SQLi-PoC	POC	CVE-2026-60137	github_poc
GitHub Bhanunamikaze/WP2Shell-CVE-2026-63030-POC: PoC detector & safe validator for the WP2Shell WordPress vulnerability chain: CVE-2026-63030 (REST batch-route confusion	POC	CVE-2026-60137	github_poc
GitHub BlueShield-Ch4rl13/ScriptNewsCTI: Panel de ciberamenazas que se actualiza solo: nuevas amenazas y vulnerabilidades activas cada 6 horas.	POC	CVE-2026-60137	github_poc
GitHub BytesPulse-OE/wp2shell-Hestia-Scanner: Read-only WordPress security scanner for HestiaCP servers. Detects wp2shell compromise indicators (CVE-2026-63030 / CVE-	POC	CVE-2026-60137	github_poc
GitHub Byungju/cve-research-lab: 주요 CVE 분석	POC	CVE-2026-60137	github_poc
GitHub Ch4120N/CVE-2026-63030: CVE-2026-63030 - WordPress REST Batch Route-Confusion SQL Injection Proof of Concept	POC	CVE-2026-63030	github_poc
GitHub ChPratik/Threat_intelligence_Portfolio: End-to-end technical analysis and reproduction notes for high-impact CVEs (e.g., pre-auth RCEs, sandbox escapes, and pri	POC	CVE-2026-60137	github_poc
GitHub ChiefYoru/CVE-2026-63030_PoC: CVE-2026-63030 - WordPress Core Pre-Auth RCE Mass Exploit	POC	CVE-2026-63030	github_poc
GitHub Colere-Sys/wp2shell-poc: Analysis and end-to-end implementation of the patched wordpress RCE vulnerability - CVE-2026-60137 and CVE-2026-63030	POC	CVE-2026-60137	github_poc
GitHub CrackerCat/feed	POC	CVE-2026-63030	github_poc
GitHub Crypto-Cat/wp2shell: PoC for CVE-2026-63030 + CVE-2026-60137, AKA WP2Shell	POC	CVE-2026-60137	github_poc
GitHub CryptoGenNepal/CVE-KEV-RSS: CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild and CryptoGen Nepal aims	POC	CVE-2026-60137	github_poc
GitHub DeadExpl0it/wp2shell-poc	POC	CVE-2026-60137	github_poc
GitHub DevGreick/devgreick	POC	CVE-2026-60137	github_poc
GitHub Dungsocool/CVE-2026-60137-CVE-2026-63030	POC	CVE-2026-60137	github_poc
GitHub Dungsocool/CVE-2026-60137_CVE-2026-63030	POC	CVE-2026-60137	github_poc
GitHub Edu34061284/wptest: wordpress Schwachstelle	POC	CVE-2026-60137	github_poc
GitHub GMJayy/wp-cve-poc	POC	CVE-2026-60137	github_poc
GitHub GhostInExile/CVE-2026-63030-Wp2Shell: WordPress REST API SQLi to RCE (CVE-2026-63030)	POC	CVE-2026-60137	github_poc
GitHub GhostTroops/TOP: TOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things	POC	CVE-2026-60137	github_poc
GitHub Giangdurian/CVE-2026-63030-CVE-2026-60137	POC	CVE-2026-60137	github_poc
GitHub HappyHackingSpace/vt-templates	POC	CVE-2026-63030	github_poc
GitHub Hidan404/Pentest	POC	CVE-2026-63030	github_poc
GitHub INFOKOM-KI/wp2shell-wazuh: WP2Shell Detection For Wazuh SIEM	POC	CVE-2026-60137	github_poc
GitHub Icex0/wp2shell-poc: wp2shell (CVE-2026-63030) - full RCE chain	POC	CVE-2026-63030	github_poc
GitHub Industri4l-H3ll-Xpl0it3rs/CVE-2026-63030-WP2Shell: CVE-2026-63030-WP2Shell \| by gr1tx	POC	CVE-2026-63030	github_poc
GitHub InstaWP/wp2shell-scan: Detect & clean up wp2shell (CVE-2026-63030) WordPress compromise — bulk-runnable, read-only by default	POC	CVE-2026-63030	github_poc
GitHub J4ck3LSyN-Gen2/CVE-2026-63030-wp2r00t: A fully red-team(offensive security) weaponized variant of wp2shell, built for authorized penetration testing & educatio	POC	CVE-2026-63030	github_poc
GitHub J4ck3LSyN-Gen2/J4ck3LSyN-Gen2	POC	CVE-2026-63030	github_poc
GitHub JohenLastGen-JLG/wp2shell: wp2shell - WordPress RCE & PoC (CVE-2026-63030 + CVE-2026-60137)	POC	CVE-2026-60137	github_poc
GitHub K52-ai/CVE-2026-63030	POC	CVE-2026-60137	github_poc
GitHub K52-ai/wp2shell: wp batch route exploitation toolkit CVE 2026-63030+CVE 2026-60137	POC	CVE-2026-60137	github_poc
GitHub Ka01nq/WpScc	POC	CVE-2026-60137	github_poc
GitHub Lukols-Dev/wp-cve-2026-63030-check: Non-intrusive exposure checker for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030 / CVE-2026-60137).	POC	CVE-2026-60137	github_poc
GitHub M4xSec/wp2shell-Exploit-Waf-Bypass: WordPress Pre-Auth RCE Exploit + Scanner + WAF Bypass \| CVE-2026-63030 + CVE-2026-60137 \| Go + Python + Metasploit modul	POC	CVE-2026-60137	github_poc
GitHub M4xSec/wp2shell-lab	POC	CVE-2026-60137	github_poc
GitHub MRdark-ops/ProofCMS-: DAST tool to check if a given Wordpress/Joomla application is vulnerable or not, with built-in exploits.	POC	CVE-2026-60137	github_poc
GitHub MRdark-ops/WP2Shell--CVE-2026-63030-CVE-2026-60137-: Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a Word	POC	CVE-2026-60137	github_poc
GitHub MangelZabalaDevelop/wp2shell	POC	CVE-2026-60137	github_poc
GitHub MataKucing-OFC/NemesisV3: RedTeam Tools	POC	CVE-2026-60137	github_poc
GitHub MatterSolutions/wp2shell-check: A single read-only script that answers the two questions that matter after the wp2shell WordPress core vulnerability	POC	CVE-2026-60137	github_poc
GitHub Mr-xn/Penetration_Testing_POC: 渗透测试有关的POC、EXP、脚本、提权、小工具等---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss	POC	CVE-2026-60137	github_poc
GitHub NONAME-ELV/elv-wp2shell: Founder E.L.V Engine	POC	CVE-2026-60137	github_poc
GitHub Nulvex-Security/nulvex-detections: Sigma, Suricata and Wazuh detection rules from Nulvex Security Research. Each rule states whether it has actually been t	POC	CVE-2026-63030	github_poc
GitHub OffByOn3/CVE-2026-63030-Wp2Shell: WordPress REST API SQLi to RCE (CVE-2026-63030)	POC	CVE-2026-60137	github_poc
GitHub OffByOn3/wp2shell-poc: WordPress REST API SQLi to RCE (CVE-2026-63030)	POC	CVE-2026-60137	github_poc
GitHub Oraink-News/tech-digest: 灵砚 Oraink 公开科技互联网日报/周报归档，汇聚公众号、推特、博客、Newsletter 等优质创作者与一线团队文章。	POC	CVE-2026-60137	github_poc
GitHub Ostorlab/KEV: Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsu	POC	CVE-2026-60137	github_poc
GitHub Procjevt/CVE-2026-63030	POC	CVE-2026-63030	github_poc
GitHub Red-Fern/fail2ban-wp2shell: Repo for fail2ban filter for the wp2shell exploit	POC	CVE-2026-60137	github_poc
GitHub RicheByte/cyberNews	POC	CVE-2026-60137	github_poc
GitHub SaltyHash8334/server: Pearl homeserver administration guide	POC	CVE-2026-60137	github_poc
GitHub Sec-Dan/WP2Shell-Scanner: Read-only CLI to check whether a WordPress site is exposed to WP2Shell (CVE-2026-63030 / CVE-2026-60137)	POC	CVE-2026-60137	github_poc
GitHub SentinelXofficial/sxwp2shell: WordPress wp2shell pre-auth RCE exploit kit (CVE-2026-63030 + CVE-2026-60137)	POC	CVE-2026-60137	github_poc
GitHub TadeasDitte/Rozhanitsy: Yet anothe shared hosting cve scanner	POC	CVE-2026-63030	github_poc
GitHub Thanfees/web2shell_auto	POC	CVE-2026-60137	github_poc
GitHub Threekiii/CVE: 一个 CVE 漏洞预警知识库，无 exp/poc，部分包含修复方案。A knowledge base of CVE security vulnerability, no PoCs/exploits.	POC	CVE-2026-60137	github_poc
GitHub TomorrowX6/CVE-2026-63030-poc	POC	CVE-2026-63030	github_poc
GitHub TranDongA3/POC-CVE-2026-63030-CVE-2026-60137-	POC	CVE-2026-60137	github_poc
GitHub TreasureBoy520/sec_profile: Restored from anonymous99-Rise	POC	CVE-2026-63030	github_poc
GitHub TreasureBoy99/sec_profile: Restored from anonymous99-Rise	POC	CVE-2026-63030	github_poc
GitHub Triotion/WP-Scanner: Wordpress Security Scanner && Auto Exploiter	POC	CVE-2026-60137	github_poc
GitHub Vr00mm/honeypot-writeup	POC	CVE-2026-60137	github_poc
GitHub WPGuard-ai/wp2shell-check: A single read-only script that answers the two questions that matter after the wp2shell WordPress core vulnerability	POC	CVE-2026-60137	github_poc
GitHub WhiteK0T/Base-of-knowledge	POC	CVE-2026-60137	github_poc
GitHub YYX1000/vullab: 使用docker对漏洞环境进行复现	POC	CVE-2026-60137	github_poc
GitHub ZenithGenius/wordpress-batch-rce-lab: CVE-2026-63030: WordPress REST batch-endpoint array desync. Mechanism, detection, mitigation, and a safe reproduction la	POC	CVE-2026-60137	github_poc
GitHub ZephrFish/wp2shell-scanner: CVE-2026-63030, CVE-2026-60137, wp2shell scanner	POC	CVE-2026-60137	github_poc
GitHub administrator-01001/CVE-2026-63030: Proof-of-concept exploit for CVE-2026-63030, a pre-authentication vulnerability in WordPress (versions 6.9.0 through 7.0	POC	CVE-2026-63030	github_poc
GitHub advision-development/wordpress-malware-quick-scan: Non-remediating WordPress malware scanner. Reports suspicious files, core integrity drift and campaign indicators for ma	POC	CVE-2026-60137	github_poc
GitHub aespasa/wp2shell-fixer	POC	CVE-2026-60137	github_poc
GitHub allannjuguna/Wp2Shell: Proof-of-concept for an unauthenticated SQL injection in WordPress core that is chainable to remote code execution, via	POC	CVE-2026-60137	github_poc
GitHub alltrad3s/ratsweepr	POC	CVE-2026-60137	github_poc
GitHub ananay/wp2shell-lab: Validation target: minimal WordPress core slice reproducing the wp2shell (CVE-2026-63030 + CVE-2026-60137) REST-to-SQLi	POC	CVE-2026-60137	github_poc
GitHub anupamjaiswall/OSCP-Checklist	POC	CVE-2026-63030	github_poc
GitHub anupamjaiswall/OSCP-web-app	POC	CVE-2026-63030	github_poc
GitHub anxkhn/my-awesome-stars	POC	CVE-2026-60137	github_poc
GitHub ark0-nights/cve_exps	POC	CVE-2026-60137	github_poc
GitHub arvindear/wp2shell-PoC: CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept	POC	CVE-2026-60137	github_poc
GitHub b1bek/wp2shell	POC	CVE-2026-60137	github_poc
GitHub bahartanir/wp2shell-scanner: CVE-2026-63030 / CVE-2026-60137 - WordPress pre-auth RCE scanner	POC	CVE-2026-60137	github_poc
GitHub barmi/cve-patch-auditor: Audit CVE impact, patch status, remediation progress, and verification results across systems.	POC	CVE-2026-60137	github_poc
GitHub beuningenit/wp2shell-fix: A tool that attacks the recent WP 2 Shell bug within WordPress.	POC	CVE-2026-60137	github_poc
GitHub byst4nder/starList	POC	CVE-2026-63030	github_poc
GitHub c0gnit00/Wp2Shell: Exploit POC for Wp2Shell, CVE-2026-63030 + CVE-2026-63137	POC	CVE-2026-60137	github_poc
GitHub codeb0ssx/Ultimate-wp2shell: wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author	POC	CVE-2026-60137	github_poc
GitHub createdbyray/CybersecurityLabs: My experience with running/exploiting virtual machines intended for red/blue team + malware anaylsis.	POC	CVE-2026-60137	github_poc
GitHub cx0110/OssTrending	POC	CVE-2026-60137	github_poc
GitHub dany547/adc-core-security: Basic Wordpress Security plugin	POC	CVE-2026-60137	github_poc
GitHub derealkello011-ui/wp2shell	POC	CVE-2026-60137	github_poc
GitHub dick318/awesome-stars	POC	CVE-2026-63030	github_poc
GitHub dinosn/wp2shell-lab: Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 autho	POC	CVE-2026-60137	github_poc
GitHub dyeat/cve-reproduction: A collection of CVE reproductions with proof-of-concept code, technical analyses, and detailed write-ups. For defensive	POC	CVE-2026-63030	github_poc
GitHub ebrasha/abdal-cve-2026-60137: Abdal CVE-2026-60137 is an advanced WordPress security scanner for identifying systems potentially affected by the CVE-2	POC	CVE-2026-60137	github_poc
GitHub ebrasha/abdal-cve-2026-63030: Abdal CVE-2026-63030 is a professional WordPress vulnerability scanner designed to detect exposure to CVE-2026-63030 thr	POC	CVE-2026-60137	github_poc
GitHub edenzaraf/wp2shell	POC	CVE-2026-60137	github_poc
GitHub ekomsSavior/wp2shell: CVE-2026-63030 (RCE) + CVE-2026-60137 (SQLi)	POC	CVE-2026-60137	github_poc
GitHub elonma-china/wp2shell-lab	POC	CVE-2026-60137	github_poc
GitHub emaag/course-discovery	POC	CVE-2026-60137	github_poc
GitHub enhansome/enhansome-web-hacking	POC	CVE-2026-60137	github_poc
GitHub exploitcartel/bank-of-cyber	POC	CVE-2026-60137	github_poc
GitHub exploitcartel/bank-of-cyber-v2	POC	CVE-2026-60137	github_poc
GitHub exploitmatic/exploitmatic	POC	CVE-2026-60137	github_poc
GitHub exploitmatic/solutions	POC	CVE-2026-60137	github_poc
GitHub eyesecurity/wp2shell-compromise-scanner-plugin: Read-only WordPress plugin that scans for artifacts of the wp2shell exploit chain (CVE-2026-63030 / CVE-2026-60137)	POC	CVE-2026-60137	github_poc
GitHub fkie-cad/nvd-json-data-feeds: Community reconstruction of the legacy JSON NVD Data Feeds. This project uses and redistributes data from the NVD API bu	POC	CVE-2026-60137	github_poc
GitHub fl0ydsec/CVE-2026-63030: WP2Shell - CVE-2026-63030 + CVE-2026-60137 WordPress Core pre-auth RCE mass exploit	POC	CVE-2026-60137	github_poc
GitHub fl0ydsec/fl0ydsec: FloydRoot	POC	CVE-2026-60137	github_poc
GitHub fullhunt/wp2shell-scan: A scanner and proof-of-concept toolkit for CVE-2026-63030 (wp2shell) - pre-authenticated remote code execution in WordPr	POC	CVE-2026-63030	github_poc
GitHub g0d150ne/WP2Shell: WP2Shell is a powerful and modular exploit framework that combines two critical WordPress vulnerabilities (CVE-2026-6303	POC	CVE-2026-60137	github_poc
GitHub gagaltotal/CVE-2026-63030-CVE-2026-60137-wp2shell-poc: CVE-2026-63030 & CVE-2026-60137 Wp2shell Poc	POC	CVE-2026-60137	github_poc
GitHub galletitaconpate/CVEs	POC	CVE-2026-63030	github_poc
GitHub galletitaconpate/galletitaconpate	POC	CVE-2026-63030	github_poc
GitHub galletitaconpate/verified-exploits	POC	CVE-2026-63030	github_poc
GitHub gichirimaku/wp2shell-PoC: CVE-2026-63030 + CVE-2026-60137 exploit RCE chain.	POC	CVE-2026-60137	github_poc
GitHub giterlizzi/secdb-feeds: SecDB - Security Feeds	POC	CVE-2026-60137	github_poc
GitHub h00die/vulnerable_docker_images: This repo is some work just to make vulnerable docker images so I have a target network	POC	CVE-2026-60137	github_poc
GitHub harezadmm/omp-enhanced: OMP Enhanced Client v2.0.0 - Multi-model fallback, prompt templates, caching	POC	CVE-2026-60137	github_poc
GitHub hidden-investigations/wp2shell-scanner: WordPress wp2shell vulnerability-chain scanner for CVE-2026-63030 and CVE-2026-60137, with active detection, optional Po	POC	CVE-2026-60137	github_poc
GitHub hiifong/starList: Export your star's repository list	POC	CVE-2026-63030	github_poc
GitHub hitechcloud-vietnam/wp2shell-PoC: CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept	POC	CVE-2026-60137	github_poc
GitHub hsamnguyen/lastest-update-bounty	POC	CVE-2026-63030	github_poc
GitHub iAm-182/wp-cve-alert: Feed CVE WordPress dari cvelistV5 di Cloudflare Workers + D1	POC	CVE-2026-63030	github_poc
GitHub ifannote/wp2shell-scan	POC	CVE-2026-63030	github_poc
GitHub ikow/wp2shell: wp2shell — WordPress Core Pre-Auth RCE (CVE-2026-63030 + CVE-2026-60137). Exploit toolkit + remediation.	POC	CVE-2026-60137	github_poc
GitHub imXur/WordPress-CVE-2026-63030-Analysis: Technical analysis, root cause breakdown, and non-destructive detection methodology for CVE-2026-63030.	POC	CVE-2026-63030	github_poc
GitHub imfht/cve-cn: AIGCVE 神龙精选 CVE 中文情报榜（每周自动更新，原站 cve.imfht.com）	POC	CVE-2026-63030	github_poc
GitHub infoslack/awesome-web-hacking: A list of web application security	POC	CVE-2026-60137	github_poc
GitHub interim-embryoniccell971/wp2shell-Exploit-Waf-Bypass: Exploit WordPress pre-auth RCE vulnerabilities with automated WAF bypass to gain unauthenticated shell access.	POC	CVE-2026-60137	github_poc
GitHub ivanesk315/CVE-2026-60137-and-CVE-2026-63030	POC	CVE-2026-60137	github_poc
GitHub jamineneves54-gif/Ciberseguran-a-guia-notebooklm: Notebook desenvolvido para especializar um modelo de linguagem em cibersegurança utilizando KLM Gemini, demonstrando téc	POC	CVE-2026-63030	github_poc
GitHub jazzsequence/wp2shell-version-audit: Checks all of your Pantheon sites for versions of WordPress affected by the wp2shell vulnerability	POC	CVE-2026-60137	github_poc
GitHub jed-parsec/CVE-2026-63030-60137-wp2shell-lab: Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a Word	POC	CVE-2026-60137	github_poc
GitHub joaovicdev/EXPLOIT-CVE-2026-63030	POC	CVE-2026-60137	github_poc
GitHub johnlodan/wp2shell-rce: WordPress CVE-2026-63030 and CVE-2026-60137 security tool for detecting exposure to the WP2Shell pre-authentication RCE	POC	CVE-2026-60137	github_poc
GitHub jpremchander/dskeeper: to keep up the GitHub contributions	POC	CVE-2026-60137	github_poc
GitHub kalamensi/dbugs-cli	POC	CVE-2026-63030	github_poc
GitHub kato83/vuln-zoo: A catalog of named/branded security vulnerabilities with CVE cross-references, structured JSON data, and year-by-year ti	POC	CVE-2026-60137	github_poc
GitHub kayahalime/cve-enrichment-tool: A lightweight CVE enrichment and prioritization tool built using open-source threat intelligence sources.	POC	CVE-2026-63030	github_poc
GitHub kekewater/kanban-board: 小墨项目看板	POC	CVE-2026-60137	github_poc
GitHub killvxk/gitweekly: 收集各种有趣的github项目	POC	CVE-2026-60137	github_poc
GitHub koayxinchun4-cmd/github-trending-daily: GitHub Trending 每日自动更新 — 三日涨星热榜，保留完整历史记录	POC	CVE-2026-60137	github_poc
GitHub kopernix/WP2Shell-Vax: Repositorio nuevo para WP2Shell-Vax	POC	CVE-2026-60137	github_poc
GitHub kopernix/WPShellVax: Mitigación temporal para la cadena wp2shell de WordPress mediante protección del endpoint REST /batch/v1.	POC	CVE-2026-60137	github_poc
GitHub langz337/CVE-2026-63030	POC	CVE-2026-60137	github_poc
GitHub lanyz1/TGSEC-Qtzuu: TGSEC社区渗透套件 · 2026-09-23：cvebird最优9 harness + CVE独立仓差分 + 锁面。按攻击面组织，可喂给AI	POC	CVE-2026-60137	github_poc
GitHub lgturatti/techdrops: News about technology and digital stuff	POC	CVE-2026-60137	github_poc
GitHub lucifer0xf/wp2shell-Wordpress-TOWN: Unauthenticated Remote Code Execution (RCE) in WordPress Core allows attackers to execute arbitrary code without logging	POC	CVE-2026-60137	github_poc
GitHub manarul04/smartlog-center	POC	CVE-2026-60137	github_poc
GitHub manpisetsu/wp2shell: CVE-2026-63030 + CVE-2026-60137 exploit RCE chain	POC	CVE-2026-60137	github_poc
GitHub marc-ko/daily-trending-repo: This repo will give you the latest trending repo on github and giving you a grasp by sending email via Github Watching F	POC	CVE-2026-60137	github_poc
GitHub martynbiz/pentest-ai	POC	CVE-2026-63030	github_poc
GitHub maux339-cpu/exploits: HUB canônico unificado: AI/redteam pentest (submodules) + OSINT + DeFi skills. Lab/autorizado only. Não é dump de payloa	POC	CVE-2026-60137	github_poc
GitHub maxgfr/awesome-stars: List of repositories that I liked on Github	POC	CVE-2026-63030	github_poc
GitHub mcipekci/wp2shell: Pre-auth RCE PoC for WordPress core — chains CVE-2026-63030 (REST /batch/v1 route-confusion desync) with CVE-2026-60137	POC	CVE-2026-60137	github_poc
GitHub metrictower/funnypot-core: The HTTP deception engine behind the funnypot security engine	POC	CVE-2026-63030	github_poc
GitHub mhassani97/cve-2026-63030-lab: wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain	POC	CVE-2026-60137	github_poc
GitHub michael-kanda/Wp2shell-ioc-scanner: Defensive WordPress incident-response plugin for the "wp2shell" attack chain (CVE-2026-60137 / CVE-2026-63030): detects	POC	CVE-2026-60137	github_poc
GitHub mrmtwoj/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress: CVE-2026-60137Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 (wp2shell)	POC	CVE-2026-60137	github_poc
GitHub muhammadfaraz800/wp2shell_verify: If you have a list of wordpress domains and want to automate to check if the domains are vulnerable to wp2shell this scr	POC	CVE-2026-60137	github_poc
GitHub mverschu/CVE-2026-63030: PoC Exploit of WordPress Core Unauthenticated RCE known as WP2Shell	POC	CVE-2026-60137	github_poc
GitHub myseq/tracker: Security Tracker	POC	CVE-2026-60137	github_poc
GitHub node011/wp2shell: Vibe Coded wp2shell with IBM BOB	POC	CVE-2026-60137	github_poc
GitHub northsia/CVE-2026-60137-With-Skip-SSL: Adding --insecure to skip ssl	POC	CVE-2026-60137	github_poc
GitHub orgito1015/wb2shell-scanner	POC	CVE-2026-60137	github_poc
GitHub own2pwn-fr/wp2shell-detect: Blackbox, non-intrusive detector for wp2shell (WordPress core pre-auth RCE, CVE-2026-63030 / CVE-2026-60137). Detection	POC	CVE-2026-60137	github_poc
GitHub pantheon-systems-ps/wp2shell-audit	POC	CVE-2026-60137	github_poc
GitHub pantheon-systems-ps/wp2shell-cleanup	POC	CVE-2026-60137	github_poc
GitHub pantheon-systems-ps/wp2shell-version-audit: Checks all of your Pantheon sites for versions of WordPress affected by the wp2shell vulnerability	POC	CVE-2026-60137	github_poc
GitHub pedroMPMartins/wordpress_exploit	POC	CVE-2026-60137	github_poc
GitHub pierce403/cvehunt	POC	CVE-2026-63030	github_poc
GitHub posl-build/medium-writeups-replay	POC	CVE-2026-63030	github_poc
GitHub pressbooks/pressbooks: Open publishing. Open web. Open source.	POC	CVE-2026-63030	github_poc
GitHub purwocode/purwocode	POC	CVE-2026-60137	github_poc
GitHub pxawtyy/proofcms: A DAST tool to check if a given Wordpress/Joomla application is vulnerable or not, with built-in exploits.	POC	CVE-2026-60137	github_poc
GitHub qianqiusujiu/cve	POC	CVE-2026-60137	github_poc
GitHub raphy76/wp2shell-poc-fulljs: full javascript reproduction of CVE-2026-63030 (author_exclude, author__not_in and misalignment between validations and	POC	CVE-2026-63030	github_poc
GitHub razureink/cve-2026-63030_60137-wordpress_rce_reproduction: CVE Reproduction: cve-2026-63030_60137-wordpress_rce_reproduction	POC	CVE-2026-60137	github_poc
GitHub rechandra/wp2exp-2026: WordPress All-in-One Exploit Framework — detector, scanner, enumerator, exploit, escalation. 10 CVEs from the 2026-08 wa	POC	CVE-2026-60137	github_poc
GitHub reportedip/honeypot-server: PHP honeypot server that emulates WordPress, Drupal & Joomla to detect malicious traffic. 36 threat analyzers, automatic	POC	CVE-2026-63030	github_poc
GitHub rix4uni/medium-writeups: This repository updates latest Bug Bounty medium writeups every 10 minutes, https://readmedium.com/Medium_URL, https://a	POC	CVE-2026-63030	github_poc
GitHub rybaz/wp2shell-research	POC	CVE-2026-60137	github_poc
GitHub sahmsec/wp2shell	POC	CVE-2026-60137	github_poc
GitHub saretawa/wp2blind	POC	CVE-2026-60137	github_poc
GitHub securelayer7/WordPresShell: Pre-auth RCE PoC for CVE-2026-63030 / CVE-2026-60137 (WordPress core)	POC	CVE-2026-60137	github_poc
GitHub securitycipher/daily-bugbounty-writeups: This repository contains Bug Bounty writeups	POC	CVE-2026-63030	github_poc
GitHub sheamm1/Vulnerable-Wordpress-Lab	POC	CVE-2026-60137	github_poc
GitHub shendewa849/wp2shell-sniper: WP2Shell Sniper - Pre-auth WordPress admin creator	POC	CVE-2026-60137	github_poc
GitHub shinthink/CVE-2026-63030: WordPress Core Pre-Auth RCE via REST Batch Route Confusion + SQLi (CVE-2026-63030 + CVE-2026-60137)	POC	CVE-2026-60137	github_poc
GitHub skelersecurity/wordpress-skelersecurity-core-security-CVE-2026-63030: The wp2shell vulnerability chain represents one of the most significant WordPress Core security issues in recent years.	POC	CVE-2026-60137	github_poc
GitHub skuldlabsdev/llm-judge-cutoff: Your reference-free LLM judge is measuring its own training cutoff — field note + reference implementation (recorder → a	POC	CVE-2026-63030	github_poc
GitHub sowarma/wp2shell-PoC: CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept	POC	CVE-2026-60137	github_poc
GitHub srkyn/kev-prioritization-notes	POC	CVE-2026-60137	github_poc
GitHub sylhetyhackvenger/CMSIAF	POC	CVE-2026-63030	github_poc
GitHub tanjiti/sec_profile: 爬取secwiki和xuanwu.github.io/sec.today,分析安全信息站点、安全趋势、提取安全工作者账号(twitter,weixin,github等)	POC	CVE-2026-63030	github_poc
GitHub tcyph3r/wp2shell-cve-2026-63030-root-cause	POC	CVE-2026-60137	github_poc
GitHub theendofabbys/wp2shell-rce	POC	CVE-2026-60137	github_poc
GitHub tislars/wp2shell-check	POC	CVE-2026-60137	github_poc
GitHub tpcybersec/VulnBox	POC	CVE-2026-60137	github_poc
GitHub trungdo206/wp2shell-ctf	POC	CVE-2026-60137	github_poc
GitHub tylzars/awesome-vrre-writeups: A collection of Vulnerability Research and Reverse Engineering writeups.	POC	CVE-2026-63030	github_poc
GitHub ul0gic/corrode: High-performance security scanner for finding exposed credentials, secrets, and vulnerabilities in web applications	POC	CVE-2026-60137	github_poc
GitHub un5eeny0t/Cyber-Write-Up-Fetcher: Feed about Cybersecurity💻	POC	CVE-2026-63030	github_poc
GitHub vithanhlam/codewp-shield-monitor: CodeWP Shield Monitor (ShieldPress) — WordPress security plugin	POC	CVE-2026-60137	github_poc
GitHub vuav/vuav	POC	CVE-2026-60137	github_poc
GitHub vulnquest58/PressVector: PressVector - Advanced WordPress Vulnerability Scanner CVE-2026-63030 (REST batch route confusion) / CVE-2026-60137 (SQL	POC	CVE-2026-60137	github_poc
GitHub w00tzenheimer/feed: An auto updating feed based on the folks I follow in case I miss something.	POC	CVE-2026-60137	github_poc
GitHub w4zu/Debian_security: DSA and DLA for Debian last 14 days	POC	CVE-2026-60137	github_poc
GitHub webpro255/awesome-ai-agent-attacks: A curated timeline of real AI agent security incidents, breaches, and vulnerabilities (2024-2026). Every entry sourced a	POC	CVE-2026-60137	github_poc
GitHub wn-iqbal/wp2shell	POC	CVE-2026-60137	github_poc
GitHub x-znn/CVE-2026-63030	POC	CVE-2026-63030	github_poc
GitHub xAL6/wp2shell	POC	CVE-2026-63030	github_poc
GitHub yoerivegt/wp2shell-poc: wp2shell (CVE-2026-60137 / CVE-2026-63030)	POC	CVE-2026-60137	github_poc
GitHub yogaGymn/wp2shell	POC	CVE-2026-60137	github_poc
GitHub yottajunaid/cyber-news-bot: Automated daily cybersecurity news fetcher powered by GitHub Actions	POC	CVE-2026-60137	github_poc
GitHub yuag/wp2shell: CVE-2026-63030 + CVE-2026-60137+poc	POC	CVE-2026-60137	github_poc
GitHub yung-megafone/starred: A dynamically generated and organized list of repositories I've starred on GitHub	POC	CVE-2026-60137	github_poc
GitHub yyy123123907/wp2shell: WP2Shell 漏洞验证 PoC，用于 WordPress 安全研究、漏洞分析及授权环境下的安全检测。	POC	CVE-2026-60137	github_poc
GitHub zi3lak/wp2shell_scanner: Non-intrusive detection scanner for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030 + CVE-2026-60137). Detecti	POC	CVE-2026-60137	github_poc
GitHub zulloper/cve-poc: CVE POC repo 자동 수집기	POC	CVE-2026-60137	github_poc
Sploitus: Exploit for CVE-2026-60137	EXPLOIT	CVE-2026-60137	sploitus
Sploitus: Exploit for CVE-2026-60137	EXPLOIT	CVE-2026-60137	sploitus

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
BSI CSW	bsi_csw	government_cert		-	de	https://www.bsi.bund.de/SiteGlobals/Functions/RSSFeed/RSSNewsfeed/RSSNewsfeed_CSW.xml

Zurueck zur Eintrags-Liste