WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

Attackers are actively exploiting two critical vulnerabilities in WordPress—CVE-2026-63030 and CVE-2026-60137—to achieve unauthenticated remote code execution (RCE) and fully compromise vulnerable sites. These flaws, collectively named wp2shell, allow attackers to execute arbitrary code on default WordPress installations without requiring authentication or plugins. Security researchers have reported widespread exploitation attempts globally, with malicious actors uploading web shells, stealing credentials, and creating backdoor admin accounts. Cloudflare and Wiz have confirmed that a significant percentage of WordPress deployments were initially exposed to these issues, though remediation efforts have reduced exposure.