Critical wp2shell WordPress flaws exploited to install webshells

Attackers are leveraging critical vulnerabilities in WordPress Core, specifically CVE-2026-63030 and CVE-2026-60137, to install webshells and malicious plugins on compromised servers¹. The "wp2shell" vulnerability suite is being exploited to gain persistent access to affected systems, allowing hackers to maintain control and execute further malicious activities. The vulnerabilities affect WordPress Core, making it a widespread issue for users who have not applied the necessary patches. As a result, the attack surface has expanded, with hackers actively targeting vulnerable servers. The disclosure of CVE-2026-63030 has significant implications, as it increases the potential for exploitation. Practitioners should prioritize patching based on their exposure and evidence of exploitation, as the installation of webshells and malicious plugins can lead to severe security breaches. The exploitation of these vulnerabilities matters to security professionals, as it highlights the need for prompt patch management to prevent attackers from gaining a foothold in their systems.