Feed›Vulnerability›WordPress releases emergency update for critical ‘wp2shell’ ...
VulnerabilityCyber Insider
9.8 — CRITICAL

WordPress releases emergency update for critical ‘wp2shell’ RCE flaw

📅 18 July 2026 at 07:03 UTC📰 Cyber InsiderView original source ↗
WordPress releases emergency update for critical ‘wp2shell’ RCE flaw

The WordPress project has released emergency security updates to fix a critical vulnerability chain dubbed wp2shell, that can allow unauthenticated attackers to achieve remote code execution (RCE) on vulnerable websites. The flaws affect WordPress 6.9 through 7.0.1 and have already prompted warnings that proof-of-concept (PoC) exploits are circulating and early signs of real-world exploitation have … The post WordPress releases emergency update for critical ‘wp2shell’ RCE flaw appeared first on CyberInsider.

🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview

A critical vulnerability chain dubbed wp2shell has been discovered in WordPress, allowing unauthenticated attackers to achieve remote code execution on vulnerable websites. The vulnerability affects approximately 500 million websites worldwide.

⚙️Technical Details
CVEs
CVE-2026-60137CVE-2026-63030
Affected Systems
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2
Attack Vectors
NETWORK
💥Impact Assessment
Severity: CRITICAL
Who Is at Risk
WordPress website administrators with vulnerable installations
🛡️Recommended Actions
1Update to the latest patched version as soon as possible
2Verify that automatic updates have completed successfully
3Review servers for signs of compromise or newly deployed backdoors, particularly if patching was delayed
📦Affected Products
WordPress
🔐NVD Verified DataVERIFIED
CVE-2026-60137 ↗CVSS 5.9 — MEDIUM
Attack Vector
NETWORK
Complexity
HIGH
Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-89
CVE-2026-63030 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-436

Read the full article

This is a curated summary. The complete article is available at Cyber Insider.

Read on Cyber Insider ↗
← Back to feed