WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

Attackers are exploiting two critical WordPress vulnerabilities that allow for unauthenticated remote code execution and complete website compromise. These vulnerabilities are referred to as wp2shell and are tracked as CVE-2026-63030 and CVE-2026-60137. Exploitation of these flaws has been observed, with successful attacks already occurring by early Saturday morning UTC. The combination of the two vulnerabilities enables attackers to gain control of vulnerable websites. The public availability of an exploit is contributing to the growth of exploitation attempts. Mass scanning for vulnerable websites is underway.