Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers.
The critical exploit chain abuses the WordPress REST API’s batch-processing feature, allowing remote attackers to execute code on vulnerable installations without the need to authenticate.
Although the technical details were not released, proof-of-concept exploits started to emerge over the weekend, shortly after threat intelligence and cyber risk management company SearchLight Cyber disclosed the wp2shell security issue.
Active exploitation was quickly confirmed, immediately after WordPress addressed the problem in versions 7.0.2, 6.9.5, and 6.8.6, forcing automatic security updates for supported installations.
Cloud security company Wiz has shared technical details about observed attacks leveraging wp2shell, saying that threat actors performed the following activities:
