Critical WP2Shell WordPress Flaws Actively Exploited in the Wild
Two newly disclosed vulnerabilities in the WordPress core, collectively dubbed WP2Shell, are being actively exploited in the wild just days after patches shipped. Tracked as CVE-2026-60137 (a high-severity SQL injection flaw) and CVE-2026-63030 (a critical arbitrary code execution bug), the chain requires no authentication and no plugins on a default WordPress install, making it a low-effort, high-impact target for attackers. WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected, and the WordPress.org team has pushed forced updates through the auto-update system following the release of patched versions 6.9.5 and 7.0.2. Site owners who have not yet upgraded are strongly encouraged to verify their server exposure using a port scanner and confirm transport security with an SSL/TLS checker.
The flaws were discovered by researchers at Searchlight Cyber, who disclosed them to the WordPress core team before coordinated public release. When chained, the two bugs grant an anonymous attacker full unauthenticated remote code execution on the target host, enabling site defacement, credential theft, malware staging, and pivot into underlying infrastructure. Cloudflare has already deployed detection rules to block known exploitation patterns, but unpatched self-hosted installations on bare or lightly managed VPS environments remain particularly exposed. Hosting providers running managed WordPress stacks have begun rolling out the patch automatically, though coverage is incomplete.
In-the-wild activity has been independently confirmed by Patchstack, Hexastrike, and WatchTowr. Hexastrike first observed exploitation attempts in its honeypots over the weekend and has since assisted with multiple incident response engagements, while WatchTowr CEO Benjamin Harris warned SecurityWeek that WordPress runs on hundreds of millions of sites, many of which are unlikely to be auto-patched in time. Harris also pointed to a stark shift in the threat landscape: PoC exploits appeared online within hours of disclosure, a window that historically took 24 hours or more, attributing the acceleration to AI-assisted vulnerability discovery tooling now used by both defenders and attackers.
For site owners and administrators, the immediate priorities are clear: confirm the running WordPress version is 6.9.5 or 7.0.2 (or later), rotate any credentials that may have been exposed on the host, review webserver and PHP logs for unusual POST payloads targeting admin endpoints, and audit installed plugins and themes for signs of tampering. Operators uncertain about the integrity of admin accounts or database content can run a broader privacy checkup against their domain to surface misconfigurations. The WP2Shell campaign is the latest reminder that the gap between disclosure and mass exploitation has effectively collapsed, leaving reactive patching as a losing strategy against modern WordPress threats.