WP2Shell Flaw Exposes Millions of WordPress Sites to Remote Takeover

Threat actors are actively chaining two newly disclosed vulnerabilities in the WP2Shell management plugin to achieve unauthenticated remote code execution on WordPress sites at scale, according to researchers tracking the campaign. Just three days after the flaws were published, attackers began mass-exploiting CVE-2026-60137, a remote code execution bug, together with CVE-2026-63030, an authentication bypass weakness, to upload arbitrary PHP payloads and seize administrative control of vulnerable installations. The chaining technique lets adversaries bypass authentication entirely and pivot directly to shell-level execution, effectively handing over the keys to the site in a single request.

WordPress powers more than 40% of the public web, making any unauthenticated RCE chain targeting its plugin ecosystem an instant priority for defenders. Administrators running WP2Shell are urged to update to the vendor-patched version immediately, disable the plugin if an update is unavailable, and audit their environments for indicators of compromise. Common forensic artifacts include unexpected PHP files inside wp-content/uploads, newly created administrator accounts with randomized usernames, and outbound traffic to unfamiliar IP ranges. Site owners can use an open port scanner to confirm whether administrative services are unnecessarily exposed to the internet, and a SSL/TLS checker to verify that admin panels remain encrypted and free from weak ciphers.

The exploitation velocity is a stark reminder that the gap between disclosure and mass exploitation has effectively collapsed to under 72 hours. Defenders should treat any WordPress deployment running the vulnerable plugin as actively targeted and assume hostile probing is already underway. To harden remaining attack surface, administrators should rotate all WordPress administrator credentials using a strong password checker, enforce two-factor authentication on every privileged account, segment management interfaces behind VPNs, and monitor for anomalous file-system writes. With active exploitation confirmed in the wild, patching latency now directly equates to incident likelihood.