Hackers are actively exploiting critical vulnerabilities in WordPress Core to deploy persistent webshells and malicious plugins. The wp2shell vulnerability suite affects multiple WordPress installations globally.
The wp2shell exploit chain, comprising CVE-2026-63030 and CVE-2026-60137, represents a significant threat to WordPress deployments. Attackers are leveraging these critical flaws to gain unauthorized access and establish persistent backdoors on compromised servers.
Attack Vector
The vulnerabilities allow threat actors to install webshells—malicious scripts that provide remote access—directly onto affected WordPress installations. Once deployed, these webshells enable attackers to execute arbitrary commands and maintain long-term control over compromised systems.
Impact
Compromised websites face multiple risks:
- Unauthorized data access and exfiltration
- Installation of malicious plugins for sustained persistence
- Potential malware distribution to site visitors
- Server resource hijacking for cryptomining or botnet operations
Current Status
Active exploitation has been confirmed in the wild. The vulnerability affects WordPress Core, meaning any unpatched installation running vulnerable versions is at immediate risk. Security researchers report widespread scanning activity as attackers identify and target exposed instances.
Recommendations
WordPress administrators should take immediate action:
- Update WordPress Core to the latest patched version
- Audit active plugins and remove any suspicious entries
- Review user accounts for unauthorized access
- Check server logs for suspicious webshell uploads
- Implement Web Application Firewall (WAF) rules
- Enable two-factor authentication for admin accounts
Organizations running WordPress at scale should prioritize patching across all instances and conduct comprehensive security reviews of affected systems. The critical severity rating warrants emergency response procedures.
The wp2shell vulnerability demonstrates the ongoing risk WordPress deployments face without regular security updates and monitoring.
A Unicode block invisible to human readers has transitioned from an academic curiosity used to test AI systems into an active tool for spammers. The technique exploits characters that machines process but humans cannot see.
A study found that 86% of licensed British gambling websites violate GDPR privacy requirements, using deceptive cookie banners to track users before obtaining consent.
Berlin's government is intensively reviewing 5.79TB of state data released by ransomware group Rhysida after refusing to pay a ransom demand. The leaked files reportedly contain sensitive information on national defense and threat response plans.
Cybercriminals are exploiting thousands of compromised small-business websites to distribute ClickFix malware payloads stored in smart contracts on the BNB Smart Chain, amplifying the reach of a known threat.