WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

Summary

Two critical WordPress vulnerabilities, CVE-2026-63030 and CVE-2026-60137 (wp2shell), are being actively exploited, enabling unauthenticated remote code execution and full website compromise. Exploitation is widespread, with attackers creating backdoor accounts and deploying malicious plugins. Organizations are advised to inspect their WordPress instances for suspicious activity.

Key Takeaways

1. Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites.
2. The two security flaws, tracked as CVE-2026-63030 and CVE-2026-60137, have been codenamed wp2shell.
3. From our vantage point across a global client base, we are seeing widespread impact of this vulnerability across organizations of every size and every vertical.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article relies on expert analysis and telemetry data from multiple security firms. It clearly identifies vulnerabilities and their impact, providing specific CVE numbers. While it mentions a public exploit, it avoids sensationalism and focuses on factual reporting of the threat.

Bias assessment: Technical Security Reporting. The article's primary focus is on reporting technical security vulnerabilities and their exploitation. It presents information objectively, citing security researchers and data without adopting a particular political or social stance.

Note: This article provides detailed technical information on a WordPress vulnerability. Readers should consult security professionals for specific mitigation strategies.

Credibility flag: Technical, Actionable

Claimed Facts (7)

• This statement provides specific, verifiable identifiers for the vulnerabilities.
• This presents specific data points from a named source regarding the origin of exploitation attempts.
• This details the capabilities of the exploit and the versions affected, attributed to a specific research entity.
• This provides a specific technical condition for the vulnerability's exploitability, attributed to Cloudflare.
• This statement provides specific version information related to the vulnerabilities.
• This presents statistical data from a named source regarding the prevalence of vulnerable instances.
• This details observed post-exploitation activities with a quantifiable number.

Opinions (8)

• This is a direct quote expressing an observation and interpretation of the exploitation timeline and methods.
• This is a direct quote expressing a broad assessment of the vulnerability's impact.
• This statement describes the ease of exploitation, which is an interpretation of the vulnerability's characteristics.
• This is an explanation of how the exploit works, involving interpretation of its mechanism.
• This is an interpretation of the role and function of a specific CVE within the exploit chain.
• This statement explains the root cause of the flaw, involving an interpretation of code behavior.
• This is an interpretation of observed scanning activity, suggesting a motive.
• This statement expresses an ongoing assessment and future intent based on current observations.

Claims (2)

• The mention of 'OpenAI GPT 5.6 Sol' as a tool for discovering an exploit chain is highly unusual and lacks context or substantiation, raising questions about its role and accuracy.
• While specific malware is mentioned, the claim of 'at least one case' is vague and lacks specific details or corroboration, making it difficult to verify.

Key Sources

• The Hacker News — Media
• Ravie Lakshmanan — Author
• Jake Knott — principal security researcher at watchTowr
• watchTowr — Security Research Firm
• KEVIntel — Threat Intelligence Platform
• Searchlight Cyber — Cybersecurity Firm
• Cloudflare — Cybersecurity Company
• Ben Marr — security engineer at Intruder
• Intruder — Vulnerability Management Company
• Wiz — Cloud Security Company
• Shahar Dorfman — Researcher at Wiz
• Gili Tikochinski — Researcher at Wiz