Word Press wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning
Summary: Attackers are exploiting a two-flaw WordPress chain codenamed wp2shell, tracked as CVE-2026-63030 and CVE-2026-60137, which together allow unauthenticated remote code execution on stock WordPress installs, with successful exploitation underway by early Saturday UTC using public exploit code to exfiltrate hashed credentials before RCE followed. KEVIntel linked 13 unique IP addresses from Switzerland, Germany, the U.K., Indonesia, Lithuania, the Netherlands, and Singapore to exploitation of CVE-2026-63030, while Wiz reported that 60% of organizations using WordPress initially had at least one vulnerable instance and 25% were exposing a vulnerable server to the Internet.
Key Takeaway: WatchTowr's honeypots logged tens of thousands of exploitation attempts and more than 100 backdoor administrator accounts were created after exploitation, so patching alone does not clear an intrusion that has already landed.