WP2Shell WordPress Vulnerabilities Exploited in the Wild

Security reporting outlet **SecurityWeek** disclosed that attackers have begun exploiting two new **WordPress** vulnerabilities tracked as **CVE-2026-60137** and **CVE-2026-63030** in the wild. Known in connection with **WP2Shell**, malicious activity leveraging these flaws commenced shortly after public disclosure occurred.

The **WP2Shell** security issues center on structural vulnerabilities within **WordPress**, identified individually under **CVE-2026-60137** and **CVE-2026-63030**. The primary operational mechanism of threat execution relies on post-disclosure timing, where attackers operationalized exploits almost immediately after technical information regarding the bugs became available.

For software engineers and platform administrators managing **WordPress** infrastructure, the rapid threat transition of **CVE-2026-60137** and **CVE-2026-63030** eliminates traditional grace periods for patch testing. The emergence of **WP2Shell** exploits in active wild environments requires immediate technical verification of running instances to prevent compromise.

Given the extensive market footprint of **WordPress** across web deployment, public disclosures reported by **SecurityWeek** attract immediate adversary attention. The concurrent exploitation of **CVE-2026-60137** and **CVE-2026-63030** demonstrates how threat actors actively scan web application environments to capitalize on newly published **WP2Shell** entry points.

Engineers maintaining affected systems should continuously audit site logs for indicators related to **CVE-2026-60137** and **CVE-2026-63030**. Technical teams must track continuing operational advisories from **SecurityWeek** and monitor further reports detailing **WP2Shell** threat activity to ensure ongoing security posture across **WordPress** installations.