WordPress Core wp2shell flaws actively exploited for webshell deployment

Affected Systems

WordPress Core (specific versions not disclosed). Both CVE-2026-63030 and CVE-2026-60137 affect core WordPress installations, enabling remote attackers to deploy webshells and malicious plugins.

Exploitation Status

Active exploitation confirmed. Attackers are deploying persistent webshells and installing malicious plugins on vulnerable WordPress servers in the wild.

Business Impact

Critical risk for organizations running WordPress sites. Successful exploitation grants attackers persistent access to web servers, enabling data theft, site defacement, malware distribution, and lateral movement within networks. Given WordPress powers over 40% of websites globally, attack surface is extensive. Incident response teams should prioritize detection and remediation immediately.

Urgency

🔴 Immediate

Recommended Actions

• Update all WordPress Core installations to the latest patched version immediately via wp-admin or WP-CLI
• Scan all WordPress installations for unauthorized plugins, themes, and PHP files in wp-content/uploads and wp-includes directories
• Review web server access logs for suspicious POST requests to wp-admin/admin-ajax.php and wp-admin/admin-post.php endpoints
• Deploy file integrity monitoring on WordPress core files and enable audit logging for plugin/theme installations
• Isolate compromised WordPress servers, rotate all admin credentials, database passwords, and API keys