Critical wp2shell WordPress flaws exploited to install webshells
Critical wp2shell WordPress flaws exploited to install webshells and malicious plugins.
Hackers are actively exploiting critical vulnerabilities in WordPress Core, dubbed 'wp2shell' (CVE-2026-63030 and CVE-2026-60137), to deploy webshells and malicious plugins. The exploit chain abuses the WordPress REST API's batch-processing feature, allowing unauthenticated remote code execution. While WordPress has released patches, active exploitation has been confirmed, with attackers scanning for vulnerable sites, uploading malicious add-ons, and attempting to steal credentials.
AI summary of the linked source. Not reviewed by an editor. How this works
Run SearchLight Cyber?
Get an email when a new story names SearchLight Cyber, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are actively exploiting two critical unauthenticated remote code execution vulnerabilities (CVE-2026-63030 and CVE-2026-60137) in WordPress Core by abusing the REST API's batch-processing feature to deploy webshells and malicious plugins. The core failure is delayed or absent patch application on internet-facing WordPress installations, leaving sites exposed even after fixes are available. This matters because webshells provide persistent, covert backdoor access that can lead to credential theft, data exfiltration, and full site compromise. The supply of malicious plugins further expands the attack surface, demonstrating how unpatched CMS platforms become launchpads for broader infrastructure attacks.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-63030
- cve — CVE-2026-60137