WordPress is once again in the cybersecurity spotlight. This time, attacks are increasing because public exploit code for wp2shell is now being used.

The issue is serious because wp2shell can lead to remote code execution. In simple terms, attackers may run code on a vulnerable website.

The two vulnerabilities involved are CVE-2026-63030 and CVE-2026-60137. When chained together, they can allow attackers to compromise WordPress sites without logging in.

Because of this, website owners should check their WordPress version immediately.

What Is wp2shell?

wp2shell is the name of an exploit chain in WordPress Core. It does not come from a plugin or theme.

This makes the risk more serious. Many site owners usually focus on plugin updates. But in this case, the issue sits in the main WordPress software.

With wp2shell, attackers can target unpatched WordPress sites. The attack can work without a user account.

That is why this issue needs fast action.

Why This Attack Matters

wp2shell matters because it can enable remote code execution. This means an attacker may make the server run malicious code.

If the attack works, the attacker may install a backdoor. After that, they may keep access to the website.

Attackers may also create fake administrator accounts. These accounts can help them return even after the original flaw is patched.

As a result, updating alone may not be enough. The website also needs to be checked for signs of compromise.

Two Vulnerabilities in One Chain

The wp2shell attack chain involves two main vulnerabilities.

CVE-2026-60137 is a SQL injection flaw. It affects WordPress version 6.8 and later.

CVE-2026-63030 is an unauthenticated remote code execution flaw. It affects WordPress version 6.9 and later under certain conditions.

When attackers combine these issues, the risk becomes much higher. They may abuse the WordPress request path to reach code execution.

Affected WordPress Versions

WordPress version 6.8 and later are affected by the SQL injection flaw.

The remote code execution issue affects WordPress version 6.9 and later. However, some conditions also matter, such as whether persistent object cache is in use.

WordPress has released fixes in version 7.0.2. Fixes are also available for older branches through versions 6.9.5 and 6.8.6.

WordPress 7.1 Beta 2 also includes fixes. Versions before 6.8 are not affected by these issues.

Exploitation Is Growing

After public exploit code appeared, scanning activity increased. Attackers started looking for WordPress sites that had not been updated.

Security reports also show successful attacks. Observed activity includes malicious plugin uploads, admin user enumeration, and attempts to read sensitive files.

Attackers have also deployed web shells in some cases. A web shell is a malicious file that gives remote access to the server.

In other words, this activity is not only scanning. In some cases, attackers are trying to maintain access.

Impact on Website Owners

The impact can be serious for website owners. If attackers take over a site, they may change content, steal data, or install malware.

The domain’s reputation can also be damaged. A compromised website may be used for spam, phishing, or malware delivery.

For businesses, the risk is even higher. An infected or unavailable website can affect sales, customer service, and user trust.

For this reason, website owners should not delay updates.

What Should You Check?

Website owners should check several things after updating.

First, look for new administrator accounts that you do not recognize. If you find any, remove them and change important passwords.

Second, review the plugin list. Delete any plugin that you do not recognize or did not install.

Third, check WordPress folders for suspicious files. Pay attention to new PHP files that should not be there.

Also, review server logs. Look for unusual REST API requests or suspicious login activity.

Recommended Mitigation Steps

The most important step is to update WordPress to a safe version. Use WordPress 7.0.2 or the correct backport version for your branch.

After that, do not stop at updating. Inspect the site to make sure no backdoor remains.

Next, reset passwords for all administrator accounts. If possible, enable two-factor authentication.

Also, use a Web Application Firewall, or WAF. A WAF can help block malicious requests while patching is in progress.

Extra WordPress Security Tips

Make sure auto-updates are enabled for security releases. This helps the site receive important patches faster.

Also, reduce the number of unnecessary plugins. The more plugins you run, the larger your attack surface becomes.

Use a hosting provider with active security protections. Some providers can apply virtual patches before users update manually.

Finally, keep regular backups. Backups help recovery if the website has already been infected.

Key Takeaway

wp2shell shows that WordPress Core flaws can have a wide impact. The attack is dangerous because it can work without login and may lead to remote code execution.

Since public exploit code is already available, website owners need to move quickly. Updating WordPress is the first required step.

However, patching may not be enough if the site was vulnerable before. Website owners should also check admin accounts, plugins, suspicious files, and server logs.

In the end, WordPress security needs fast patching, monitoring, backups, and good website management habits.

Source: https://thehackernews.com/2026/07/wordpress-wp2shell-exploitation-grows.html