Attackers have started exploiting two critical WordPress vulnerabilities that can be chained to deliver unauthenticated remote code execution and full site compromise, with telemetry showing activity across multiple countries and tens of thousands of attempts since public exploit code appeared.
KEY FACTS
- Vulnerabilities CVE-2026-63030 and CVE-2026-60137 are being tracked as wp2shell.
- Reach KEVIntel linked 13 unique IP addresses in seven countries to exploitation of CVE-2026-63030.
- Impact Wiz said 60% of WordPress users it monitored initially had at least one vulnerable instance.
- Activity Attackers have uploaded malicious plugins, created backdoor admin accounts and deployed web shells.
A technical analysis from Searchlight Cyber said the exploit chain can give unauthenticated attackers remote code execution on default WordPress installations in versions released since December 2025. The company said the attack has no preconditions and can work on a stock install with no plugins.
Cloudflare said CVE-2026-63030 can lead to unauthenticated remote code execution only when persistent object cache is not in use, while CVE-2026-60137 affects versions from 6.8 onward and the RCE path affects versions from 6.9. The disclosure said the first flaw is a route confusion bug in the REST API batch endpoint, while the second involves improper sanitization of the author__not_in parameter in WP_Query.
Wiz said it observed post-exploitation behavior including malicious plugin uploads, user enumeration, harvesting of admin usernames and email addresses, local file inclusion attempts, access to the admin panel and bare-bones PHP web shells. The report also noted high-volume scanning without follow-on intrusion, which it said may reflect mass scanning for vulnerable targets.
WatchTowr said its honeypots recorded tens of thousands of exploitation attempts after public exploit code was released. It also said more than 100 backdoor administrator accounts were created in some cases, and one actor repeatedly tried to install Overlord RAT, a Golang-based remote access trojan.
WHY IT MATTERS
The activity shows how quickly a WordPress flaw can turn into broad opportunistic abuse once exploit details circulate. Site operators are advised to check for new administrator accounts, malicious plugins and suspicious files, even on systems that have already been patched.