Critical WordPress wp2shell Vulnerabilities Exploited for Webshells

Hackers are actively exploiting a suite of critical vulnerabilities within WordPress Core, collectively known as "wp2shell," to gain unauthorized access and establish persistent control over affected websites. These vulnerabilities, identified by CVE-2026-63030 and CVE-2026-60137, allow attackers to deploy webshells, which are essentially backdoors that enable them to execute arbitrary commands on the compromised server. The primary objective appears to be the installation of malicious plugins, further entrenching the attackers' presence and potentially facilitating more sophisticated attacks or data exfiltration.

The exploitation of wp2shell vulnerabilities poses a significant threat to the security of WordPress websites, which power a substantial portion of the internet. Webshells provide attackers with a direct command-line interface to the server, bypassing normal authentication mechanisms. This allows them to perform a wide range of malicious activities, including modifying website content, stealing sensitive data, or using the compromised server to launch attacks against other targets. The installation of malicious plugins is a common tactic used to maintain persistence and expand the attack surface.

While the exact timeline of the initial discovery and exploitation of these specific CVEs is not detailed, the active exploitation indicates that patches may not have been universally applied by website administrators. WordPress Core is a foundational component for millions of websites, making any critical vulnerability within it a high-priority concern for security professionals and website owners alike. The nature of the exploit suggests a sophisticated understanding of the WordPress architecture and its underlying code.

Security researchers are urging all WordPress users to update their installations to the latest version immediately to mitigate the risk of these attacks. Regular security audits and the use of reputable security plugins can also help detect and prevent the installation of malicious code. The ongoing exploitation of such critical flaws underscores the persistent need for vigilance in website security practices.