Affected Systems

WordPress core (specific versions not disclosed). CVE-2026-63030 and CVE-2026-60137 must be chained for unauthenticated remote code execution. All unpatched WordPress installations are potentially vulnerable.

Exploitation Status

Active exploitation confirmed as of early Saturday morning UTC. Public exploits available. Mass scanning campaigns underway targeting vulnerable WordPress installations.

Business Impact

Critical risk for organizations running WordPress. Unauthenticated RCE allows attackers full server compromise, data theft, malware deployment, and lateral movement. Public exploit code accelerates attacker capability. Expect widespread scanning and automated exploitation attempts. Incident response teams should prioritize detection and patching.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately update all WordPress core installations to the latest patched version released by WordPress.org
  • Review web server logs for suspicious POST requests, file upload attempts, and unexpected PHP execution patterns since exploit publication
  • Deploy WAF rules or virtual patches blocking known wp2shell exploit patterns if immediate patching is not feasible
  • Scan WordPress installations for webshells, backdoors, and unauthorized administrative accounts created after initial exploit availability
  • Isolate or take offline any WordPress instances showing signs of compromise until forensic analysis and remediation complete