'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover
PoC publicWordPress CoreOur summary
Two critical vulnerabilities in WordPress, CVE-2026-60137 and CVE-2026-63030, are being actively exploited to enable unauthenticated remote code execution (RCE) on millions of sites. When combined, these flaws allow attackers to fully compromise default installations without needing login credentials. The vulnerabilities were discovered using AI tools and have already led to widespread exploitation, including the creation of backdoor admin accounts and deployment of malware like Overlord RAT. WordPress has issued a patch in version 7.0.2, urging all users to update immediately.
Dark Reading publishes this story on its own site; we link to it rather than reprint it.
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.