What happens if you visit a WordPress site hacked through wp2shell?

Visitors to a WordPress site compromised through the wp2shell vulnerability chain are at risk of being targeted by various malicious activities, including scams, credential theft, and malware distribution¹. The wp2shell vulnerabilities, which affect the WordPress Core, can be exploited without authentication, making them particularly concerning. Unlike other vulnerabilities that require a malicious plugin, wp2shell can be exploited directly, allowing attackers to use the compromised site as a delivery mechanism for malicious content. This can lead to a range of negative consequences for visitors, including the theft of sensitive information and the installation of malware. The fact that these vulnerabilities can be exploited without authentication highlights the importance of keeping WordPress sites up to date with the latest security patches. So what matters to practitioners is that a single unpatched WordPress site can put numerous visitors at risk of falling victim to various cyber threats.