[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvm1_gH7El1juirHWW__2E_YA3OVbR_ylS9s7INJLjLs":3},{"article":4,"iocs":55,"watch_terms":62,"solutions":63,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"36de568d-1ed1-460f-9525-107d953d1e7f","Critical wp2shell WordPress flaws exploited to install webshells","critical-wp2shell-wordpress-flaws-exploited-to-install-webshells-8371d6","Hackers are exploiting the \"wp2shell\" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. [...]","Hackers are actively exploiting critical vulnerabilities in WordPress Core, dubbed 'wp2shell' (CVE-2026-63030 and CVE-2026-60137), to deploy webshells and malicious plugins. The exploit chain abuses the WordPress REST API's batch-processing feature, allowing unauthenticated remote code execution. While WordPress has released patches, active exploitation has been confirmed, with attackers scanning for vulnerable sites, uploading malicious add-ons, and attempting to steal credentials.","Critical wp2shell WordPress flaws exploited to install webshells and malicious plugins.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcritical-wp2shell-wordpress-flaws-exploited-to-install-webshells\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F04\u002F15\u002FWordPress.jpg","2026-07-21T16:41:50+00:00","2026-07-21T18:00:19.479262+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"WordPress Core","product",{"name":21,"type":22},"REST API","technology",{"name":24,"type":25},"SearchLight Cyber","vendor",{"name":27,"type":25},"Wiz",{"name":29,"type":25},"Sans Technology Institute",{"name":31,"type":25},"Defiant","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60],{"type":57,"value":58,"context":59},"cve","CVE-2026-63030","wp2shell vulnerability",{"type":57,"value":61,"context":59},"CVE-2026-60137",[24,27,29],{"controls":64,"vendors":148},[65,94,119],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":95,"name":96,"problem":97,"products":98},"patch-management","Automated patch management","Known holes get closed in days, not months.",[99,103,111],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":95,"product_name":100,"url":101,"description":102},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":120,"name":121,"problem":122,"products":123},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",[149],{"slug":150,"name":27,"logo_path":151,"roles":152},"wiz","\u002Fvendor-logos\u002Fwiz.png",[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":170},"critical-wordpress-wp2shell-flaws-actively-exploited-for-webshell-deployment","Critical WordPress 'wp2shell' Flaws Actively Exploited for Webshell Deployment","Attackers are actively exploiting two critical unauthenticated remote code execution vulnerabilities (CVE-2026-63030 and CVE-2026-60137) in WordPress Core by abusing the REST API's batch-processing feature to deploy webshells and malicious plugins. The core failure is delayed or absent patch application on internet-facing WordPress installations, leaving sites exposed even after fixes are available. This matters because webshells provide persistent, covert backdoor access that can lead to credential theft, data exfiltration, and full site compromise. The supply of malicious plugins further expands the attack surface, demonstrating how unpatched CMS platforms become launchpads for broader infrastructure attacks.",[159,160,161,162,163,164,165,166,167,168,169],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST AC-3: Access Enforcement","NIST SI-7: Software, Firmware, and Information Integrity","NIST IR-5: Incident Monitoring","OWASP A05:2021 – Security Misconfiguration","OWASP A06:2021 – Vulnerable and Outdated Components","GDPR Article 32: Security of Processing (technical measures to ensure integrity)","ITIL: Change and Release Management (emergency patch procedures)",{}]