NewsBite analysis · Security
BleepingComputer
Critical wp2shell WordPress flaws exploited to install webshells
Recent critical vulnerabilities in WordPress, referred to as wp2shell, are being actively exploited by hackers to deploy webshells and install malicious plugins on vulnerable servers. This exploit uses the WordPress REST API's batch-processing feature, enabling remote attackers to execute code without authentication. Although WordPress has patched the flaws in the latest versions, the exploitation began soon after disclosure, with various malicious activities reported. Administrators are urged to apply updates immediately and check for signs of compromise.
Act nowConfidence: HighImmediate horizonCybersecurity risk: High
Published 21 Jul 2026, 16:50 UTC2 min read
Visit original article ↗Lead image — BleepingComputer
Summary
TL;DR
- Two critical vulnerabilities (CVE-2026-63030, CVE-2026-60137) found in WordPress.
- Exploits allow hackers to execute code remotely and install webshells.
- Coincided with the release of patches for affected WordPress versions.
- Attackers are targeting vulnerable installations with mass scans and SQL injections.
- Security companies report a significant patch rate, but risks remain.
Interesting facts
- Active exploitation began shortly after vulnerabilities were disclosed.
- Hackers are using a combination of SQL injection and webshell delivery.
- Significant automation is observed in the exploitation of these vulnerabilities.