Hackers are actively breaking into vulnerable WordPress sites and planting backdoors that let them keep control of the server. The 'wp2shell' chain affects WordPress Core and abuses the REST API batch-processing feature to achieve unauthenticated remote code execution using CVE-2026-63030 and CVE-2026-60137. WordPress patched the issue in versions 7.0.2, 6.9.5, and 6.8.6, and researchers observed malicious plugins, rogue admin accounts, and PHP webshells being deployed.
Why it matters: WordPress powers a large share of the public web, so active exploitation creates immediate risk for website owners, businesses, and users of compromised sites. Organizations running WordPress should update immediately, review plugins and admin accounts, and check for webshells or unusual REST API activity.
Bill Toulas
2026.09.22
90% relevant
This adds a concrete threat campaign abusing the wp2shell flaws, including breaches at at least 49 organizations in 29 countries and theft of 18,566 records from a Western government organization after the attackers used WordPress access to pivot into an internal SQL server.
Bill Toulas
2026.07.21
100% relevant
This article establishes a distinct tracked story by tying the newly disclosed wp2shell WordPress Core vulnerabilities to real-world exploitation, post-patch attack activity, and concrete indicators of compromise.
← Back to all stories