Storia in 7 fonti

WP2Shell WordPress Vulnerabilities Exploited in the Wild

In-the-wild exploitation seen for the new WP2Shell WordPress vulnerabilities, officially tracked as CVE-2026-60137 and CVE-2026-63030.

Raccontata dathehackernews.comheise.debleepingcomputer.comdev.tosecurityweek.comdarkreading.comtheregister.com

Confronto fonti

6 prospettive sulla stessa storia

AI · summaries

securityweek.comStai leggendo1 g fa

WP2Shell WordPress Vulnerabilities Exploited in the Wild

In-the-wild exploitation seen for the new WP2Shell WordPress vulnerabilities, officially tracked as CVE-2026-60137 and CVE-2026-63030.

originale

darkreading.com13 h fa

'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover

Attackers are chaining together CVE-2026-60137 and CVE-2026-63030 to lob exploit attempts against one of the largest attack surfaces on the Internet.

Leggi questa versione → originale

thehackernews.com2 h fa

WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

Attackers are exploiting two WordPress flaws as wp2shell, chaining them for unauthenticated RCE and deploying web shells and malicious plugins.

Leggi questa versione → originale

bleepingcomputer.com2 g fa

WordPress Core "wp2shell" RCE flaws get public exploits, patch now

Public exploits have been released for the critical "wp2shell" remote code execution vulnerabilities affecting WordPress Core, making it imperative that administrators patch their sites immediately.

Leggi questa versione → originale

heise.de1 g fa

wp2shell: Critical WordPress vulnerability allows code injection via API

By chaining an SQL injection and an API vulnerability, attackers can inject code. WordPress has released an update, the finders a hotfix.

Leggi questa versione → originale

theregister.com13 h fa

Attackers pummel critical WordPress vuln to create all sorts of mischief

Plus dozens of PoCs in the public domain

Leggi questa versione → originale

Timeline cronologica

1. venerdì 17 luglio 2026·thehackernews.com
   

   New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code

   WordPress 6.9.5 and 7.0.2 patch wp2shell, a pre-auth core RCE that lets anonymous attackers run code on default installs, even with no plugins.

2. sabato 18 luglio 2026·heise.de
   

   „wp2shell“: Kritische WordPress-Lücke erlaubt Codeeinschleusung über API

   Durch Verkettung einer SQL-Injection- und einer API-Lücke können Angreifer Code einschleusen. WordPress hat ein Update veröffentlicht, die Finder einen Hotfix.

3. sabato 18 luglio 2026·bleepingcomputer.com
   

   WordPress Core "wp2shell" RCE flaws get public exploits, patch now

   Public exploits have been released for the critical "wp2shell" remote code execution vulnerabilities affecting WordPress Core, making it imperative that administrators patch their…

4. domenica 19 luglio 2026·dev.to
   

   wp2shell: how a route confusion + a reachable SQLi become pre-auth RCE in WordPress core

   This is a republication. The original and always up to date version lives...

5. domenica 19 luglio 2026·heise.de
   

   wp2shell: Critical WordPress vulnerability allows code injection via API

   By chaining an SQL injection and an API vulnerability, attackers can inject code. WordPress has released an update, the finders a hotfix.

6. lunedì 20 luglio 2026·securityweek.com
   

   WP2Shell WordPress Vulnerabilities Exploited in the Wild

   In-the-wild exploitation seen for the new WP2Shell WordPress vulnerabilities, officially tracked as CVE-2026-60137 and CVE-2026-63030.

7. lunedì 20 luglio 2026·darkreading.com
   

   'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover

   Attackers are chaining together CVE-2026-60137 and CVE-2026-63030 to lob exploit attempts against one of the largest attack surfaces on the Internet.

8. lunedì 20 luglio 2026·theregister.com
   

   Attackers pummel critical WordPress vuln to create all sorts of mischief

   Plus dozens of PoCs in the public domain

9. martedì 21 luglio 2026·thehackernews.com
   

   WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

   Attackers are exploiting two WordPress flaws as wp2shell, chaining them for unauthenticated RCE and deploying web shells and malicious plugins.