Hackers are actively exploiting critical vulnerabilities in WordPress Core to deploy persistent webshells and malicious plugins. The wp2shell vulnerability suite affects multiple WordPress installations globally.
The wp2shell exploit chain, comprising CVE-2026-63030 and CVE-2026-60137, represents a significant threat to WordPress deployments. Attackers are leveraging these critical flaws to gain unauthorized access and establish persistent backdoors on compromised servers.
Attack Vector
The vulnerabilities allow threat actors to install webshells—malicious scripts that provide remote access—directly onto affected WordPress installations. Once deployed, these webshells enable attackers to execute arbitrary commands and maintain long-term control over compromised systems.
Impact
Compromised websites face multiple risks:
- Unauthorized data access and exfiltration
- Installation of malicious plugins for sustained persistence
- Potential malware distribution to site visitors
- Server resource hijacking for cryptomining or botnet operations
Current Status
Active exploitation has been confirmed in the wild. The vulnerability affects WordPress Core, meaning any unpatched installation running vulnerable versions is at immediate risk. Security researchers report widespread scanning activity as attackers identify and target exposed instances.
Recommendations
WordPress administrators should take immediate action:
- Update WordPress Core to the latest patched version
- Audit active plugins and remove any suspicious entries
- Review user accounts for unauthorized access
- Check server logs for suspicious webshell uploads
- Implement Web Application Firewall (WAF) rules
- Enable two-factor authentication for admin accounts
Organizations running WordPress at scale should prioritize patching across all instances and conduct comprehensive security reviews of affected systems. The critical severity rating warrants emergency response procedures.
The wp2shell vulnerability demonstrates the ongoing risk WordPress deployments face without regular security updates and monitoring.
Attackers are actively exploiting CVE-2026-50522, a critical remote code execution vulnerability in Microsoft SharePoint, to extract machine keys that persist even after patches are applied. The flaw enables long-term access to compromised systems.
Treasury Secretary Scott Bessent said the U.S. could sanction Chinese open-source AI models over alleged intellectual property theft. The threat expands the Trump administration's efforts to restrict China's AI development.
A newly discovered malware can infiltrate AI coding infrastructure to steal credentials and data while deploying destructive capabilities to erase files and lock out legitimate users.
Iran's Islamic Revolutionary Guard Corps (IRGC) claimed it destroyed Amazon's central data infrastructure in Bahrain using cruise missiles. Amazon has not commented on the alleged attack.