Hackers have started actively exploiting two critical WordPress vulnerabilities that can be chained together to completely take over vulnerable websites without requiring any login credentials.
The flaws, tracked as CVE-2026-63030 and CVE-2026-60137, are collectively known as wp2shell and allow attackers to achieve unauthenticated remote code execution (RCE) on affected WordPress installations.
Security researchers say exploitation began within hours of public exploit code becoming available. Early attacks initially focused on stealing hashed credentials before escalating to full remote code execution as more technical details surfaced. Researchers have already observed widespread attacks targeting organizations of all sizes across multiple industries.
Telemetry collected during the attacks has identified exploitation attempts originating from IP addresses located in Switzerland, Germany, the United Kingdom, Indonesia, Lithuania, the Netherlands, and Singapore.
The exploit chain affects default WordPress installations and requires no plugins or user interaction. According to researchers, attackers can compromise a standard WordPress site using a single HTTP request. Technical details of the attack have been intentionally withheld because of the severity of the vulnerabilities.
The attack combines two separate flaws. CVE-2026-60137 is an authentication bypass issue in the WordPress REST API batch endpoint that allows attackers to access internal functions without proper permission checks. It is then paired with CVE-2026-63030 to achieve full remote code execution. Researchers also noted that the RCE vulnerability only works when persistent object caching is not enabled. While the SQL injection flaw affects WordPress 6.8 and later, the full RCE chain impacts WordPress 6.9 and newer.
Researchers also highlighted an additional weakness involving improper sanitization of the author__not_in parameter in WP_Query. Under certain conditions, crafted input can manipulate database queries, potentially allowing unauthorized access or modification of stored data.
Google-owned Wiz reported that when the vulnerabilities were first disclosed, around 60% of organizations using WordPress had at least one vulnerable instance, while roughly 25% had an exposed vulnerable server accessible from the internet. Those numbers have declined as administrators continue installing security updates.
Following successful exploitation, attackers have been observed uploading malicious WordPress plugins, collecting administrator usernames and email addresses, performing local file inclusion attacks to obtain database credentials and authentication keys, logging into WordPress admin panels, and deploying lightweight PHP web shells that provide remote access to compromised servers.
Researchers also detected large-scale internet scanning activity searching for vulnerable WordPress websites. While many scans appear automated, others have led directly to successful compromises.
One of the more concerning discoveries is a 150 KB web shell disguised as a legitimate WordPress security plugin named CMSmap. Once installed, it provides attackers with advanced capabilities including file management, database access, port scanning, bulk code injection, and multiple privilege escalation techniques.
Security researchers have also observed attackers creating more than 100 hidden administrator accounts after compromising websites. These accounts are used to install fake plugins, execute malicious code, and download additional malware. In at least one incident, attackers repeatedly attempted to deploy Overlord RAT, a Golang-based remote access trojan.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Website administrators are strongly advised to update WordPress immediately if security patches are available and carefully inspect their websites for newly created administrator accounts, unfamiliar plugins, unexpected PHP files, or other signs of compromise. Even patched websites should be reviewed thoroughly to ensure attackers have not already established persistent access.
