WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

Attackers are actively exploiting two critical vulnerabilities in WordPress, collectively dubbed wp2shell, to achieve unauthenticated remote code execution on vulnerable sites. The exploit chain combines CVE-2026-63030 and CVE-2026-60137, enabling attackers to bypass authentication and execute arbitrary code via a single HTTP request. Post-exploitation activities include uploading malicious plugins, creating backdoor administrator accounts, deploying web shells, and attempting to install the Overlord RAT. Mass scanning is ongoing, with widespread exploitation observed globally.

AI-extracted · verify before operational use