Exploitation in the Wild of wp2shell

A critical pre-authentication remote code execution (RCE) vulnerability chain in WordPress Core, dubbed 'wp2shell' and tracked as CVE-2026-63030 and CVE-2026-60137, is being actively exploited in the wild. The vulnerabilities allow unauthenticated attackers to execute arbitrary code on vulnerable WordPress instances, leading to webshell deployment, user enumeration, and admin panel access. Multiple threat actors have been observed exploiting these flaws, deploying both simple and sophisticated PHP webshells, while mass scanning campaigns suggest widespread opportunistic targeting.

AI-extracted · verify before operational use