Affected Systems
WordPress Core (specific versions not disclosed). CVE-2026-63030 and CVE-2026-60137 affect core WordPress installations, enabling remote attackers to deploy webshells and install malicious plugins.
Exploitation Status
Active exploitation confirmed. Attackers are deploying persistent webshells and malicious plugins on vulnerable WordPress servers in the wild.
Business Impact
Organizations running WordPress face immediate risk of server compromise, persistent backdoor access, and unauthorized plugin installation. Attackers gain code execution capabilities, enabling data theft, site defacement, malware distribution, or lateral movement. Public-facing WordPress sites are high-priority targets. Specific affected versions and CVSS scores not yet published.
Urgency
🔴 Immediate
Recommended Actions
- Update WordPress Core to the latest patched version immediately via wp-admin or WP-CLI
- Scan all WordPress installations for webshells in wp-content/uploads, wp-includes, and theme directories using file integrity monitoring or tools like Wordfence CLI
- Review installed plugins and themes for unauthorized additions; remove any unrecognized or suspicious entries
- Enable WordPress audit logging and monitor for POST requests to wp-admin/admin-ajax.php, plugin-install.php, and theme-editor.php
- Implement web application firewall (WAF) rules to block exploitation attempts targeting CVE-2026-63030 and CVE-2026-60137 until patching is complete