VulnerabilityBleeping Computer
9.8 — CRITICAL
Critical wp2shell WordPress flaws exploited to install webshells
Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
Hackers are exploiting critical WordPress vulnerabilities (CVE-2026-63030 and CVE-2026-60137) to deploy persistent webshells and install malicious plugins on affected servers, allowing remote attackers to execute code without authentication.
⚙️Technical Details
Affected Systems
WordPress Core
Attack Vectors
NETWORKLOW
💥Impact Assessment
Severity: CRITICAL
Who Is at Risk
Administrators of WordPress sites with versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2
🛡️Recommended Actions
1Immediately update to the patched versions (7.0.2, 6.9.5, and 6.8.6)
2Review logs for wp2shell-related requests
3Inspect installed plugins and check for rogue PHP file additions or newly created admin accounts
📦Affected Products
WordPress Core
🔐NVD Verified DataVERIFIED
CVE-2026-63030 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-436
CVE-2026-60137 ↗CVSS 5.9 — MEDIUM
Attack Vector
NETWORK
Complexity
HIGH
Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NWeaknesses
CWE-89
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.