Hackers are actively exploiting critical vulnerabilities in WordPress Core to deploy persistent webshells and malicious plugins. The wp2shell vulnerability suite affects multiple WordPress installations globally.
The wp2shell exploit chain, comprising CVE-2026-63030 and CVE-2026-60137, represents a significant threat to WordPress deployments. Attackers are leveraging these critical flaws to gain unauthorized access and establish persistent backdoors on compromised servers.
Attack Vector
The vulnerabilities allow threat actors to install webshells—malicious scripts that provide remote access—directly onto affected WordPress installations. Once deployed, these webshells enable attackers to execute arbitrary commands and maintain long-term control over compromised systems.
Impact
Compromised websites face multiple risks:
- Unauthorized data access and exfiltration
- Installation of malicious plugins for sustained persistence
- Potential malware distribution to site visitors
- Server resource hijacking for cryptomining or botnet operations
Current Status
Active exploitation has been confirmed in the wild. The vulnerability affects WordPress Core, meaning any unpatched installation running vulnerable versions is at immediate risk. Security researchers report widespread scanning activity as attackers identify and target exposed instances.
Recommendations
WordPress administrators should take immediate action:
- Update WordPress Core to the latest patched version
- Audit active plugins and remove any suspicious entries
- Review user accounts for unauthorized access
- Check server logs for suspicious webshell uploads
- Implement Web Application Firewall (WAF) rules
- Enable two-factor authentication for admin accounts
Organizations running WordPress at scale should prioritize patching across all instances and conduct comprehensive security reviews of affected systems. The critical severity rating warrants emergency response procedures.
The wp2shell vulnerability demonstrates the ongoing risk WordPress deployments face without regular security updates and monitoring.
Threat actors are leveraging the legitimate Faronics Deploy endpoint-management platform to gain administrative control over targeted computers and install ScreenConnect remote support software.
X is investigating a surge of unsolicited password reset emails following the launch of its X Money payments service. The company believes the incidents may be connected to the new platform.
Aesto Health disclosed a data breach affecting over 9.5 million individuals. The company discovered the unauthorized access to patient information recently.
Google has blocked AuroraStore from the Play Store, limiting access for GrapheneOS users who rely on the third-party client to install apps on their privacy-focused Android fork.