Two significant security vulnerabilities in WordPress, collectively known as wp2shell, are being actively exploited by attackers. These issues allow unauthenticated remote code execution, posing a major risk to any website running a vulnerable version of WordPress.
Detailing the wp2shell Vulnerabilities
The vulnerabilities, identified as CVE-2026-63030 and CVE-2026-60137, are critical. Exploitation began swiftly after public exploit code surfaced, enabling attackers to extract hashed credentials. Jake Knott, a principal security researcher at watchTowr, highlighted the widespread impact of these flaws across various organizations.
Telemetry from KEVIntel identified 13 IP addresses across several countries, including Switzerland and Germany, as being involved in exploiting CVE-2026-63030. This flaw, discovered with the help of OpenAI’s GPT 5.6 Sol, affects default WordPress setups without additional plugins.
Understanding the Exploitation Process
Searchlight Cyber noted that the wp2shell exploit chain begins with unauthenticated SQL injection via CVE-2026-60137. This issue affects WordPress installations from version 6.8 onward, while the remote code execution vulnerability impacts version 6.9 and beyond.
Cloudflare explained that the RCE exploit is possible only when persistent object caching is not implemented. The SQL injection vulnerability stems from improper sanitization of certain parameters, which can lead to unauthorized access or data manipulation.
Consequences and Protective Measures
Data from Wiz, a Google-owned firm, indicated that 60% of organizations were initially vulnerable to these exploits. However, this figure is decreasing as more organizations apply necessary patches. Post-exploitation activities observed include uploading malicious plugins, accessing admin panels, and executing local file inclusion attacks.
WatchTowr reported that attackers are engaging in indiscriminate scanning following the release of the exploit, with tens of thousands of attempts recorded. Over 100 backdoor admin accounts have been created, facilitating further exploitation.
Organizations are advised to scrutinize their WordPress setups for any unauthorized admin accounts or suspicious plugins. Even if patches are applied, thorough checks are crucial to ensure complete elimination of the threat.
