As cited
Copy frozen at (site build).
vulnerabilities
Critical wp2shell WordPress flaws exploited to install webshells
Attackers are actively exploiting two critical vulnerabilities in WordPress Core, tracked as CVE-2026-63030 and CVE-2026-60137, to deploy webshells and malicious plugins on compromised servers. The flaws in the wp2shell vulnerability suite allow persistent remote access and malicious code installation.
Why it matters: WordPress site operators need to patch immediately, as these actively exploited critical flaws enable attackers to establish persistent backdoors and deploy malware that survives plugin updates.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Critical wp2shell WordPress flaws exploited to install webshells
Attackers are actively exploiting two critical vulnerabilities in WordPress Core, tracked as CVE-2026-63030 and CVE-2026-60137, to deploy webshells and malicious plugins on compromised servers. The flaws in the wp2shell vulnerability suite allow persistent remote access and malicious code installation.
Why it matters: WordPress site operators need to patch immediately, as these actively exploited critical flaws enable attackers to establish persistent backdoors and deploy malware that survives plugin updates.
- Source published
- First seen by Cybersecurity Tracker