Critical wp2shell WordPress flaws exploited to install webshells

Hackers are actively exploiting the wp2shell critical vulnerability suite in WordPress Core, tracked as CVE-2026-63030 and CVE-2026-60137. According to BleepingComputer, attackers use the flaws to deploy persistent webshells and install malicious plugins on compromised servers.

wp2shell targets WordPress Core itself rather than a single third-party plugin. Once the chain is abused, operators plant webshells that survive ordinary site restarts and content edits, then load malicious plugins so they keep remote control through the normal WordPress plugin path.

That combination matters for anyone who builds or runs WordPress. A Core-level issue puts default installs in scope, and a webshell plus a malicious plugin is more than a one-shot defacement: it is a foothold for file changes, credential theft, and further malware while the site still looks like a normal WordPress instance.

WordPress remains one of the most widely deployed CMS stacks on the public web, so Core RCE-style abuse tends to move faster and wider than plugin-only campaigns. Defenders and hosting providers already treat “webshell plus rogue plugin” patterns as high priority because they blend into legitimate admin and plugin workflows.

If you operate WordPress sites, treat Core patching as urgent, inventory plugins for anything you did not install, and scan for unexpected PHP webshells and unknown plugin directories. Watch vendor and security advisories for official fixes for CVE-2026-63030 and CVE-2026-60137, and confirm your hosts and managed platforms have applied those updates.