WordPress wp2shell flaws enable unauthenticated RCE, active exploitation

Affected Systems

WordPress core (specific versions not disclosed). CVE-2026-63030 and CVE-2026-60137 must be chained for unauthenticated remote code execution. All unpatched WordPress installations are at risk.

Exploitation Status

Active exploitation confirmed as of early Saturday morning UTC. Public exploits available. Mass scanning campaigns underway targeting vulnerable WordPress sites.

Business Impact

Critical risk for all WordPress installations. Unauthenticated attackers can achieve remote code execution by chaining two vulnerabilities, leading to full site compromise, data theft, malware deployment, and lateral movement. Public exploit code has accelerated mass exploitation. Immediate patching required to prevent compromise.

Urgency

🔴 Immediate

Recommended Actions

• Update all WordPress core installations to the latest patched version immediately via wp-admin or WP-CLI
• Review WordPress access logs and web server logs for suspicious POST requests or unusual plugin/theme upload activity since exploit publication
• Deploy WAF rules or IPS signatures targeting wp2shell exploit patterns if immediate patching is not feasible
• Conduct file integrity checks on WordPress core files, wp-content/uploads, and plugin directories for unauthorized modifications or webshells
• Isolate or take offline any WordPress instances that cannot be patched within 24 hours until updates are applied