WP2Shell WordPress Vulnerabilities Exploited in the Wild: Security Risks & Mitigation

Post Views: 33

Two recently addressed WordPress vulnerabilities are currently under active exploitation, with malicious activity observed shortly after their disclosure.

Researchers from Searchlight Cyber identified the issues, confirming that WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected. The security firm highlighted that the vulnerabilities require no prior conditions to exploit, allowing unauthenticated users to execute arbitrary code on default WordPress installations without plugins.

WordPress released patches on Friday, updating versions to 6.9.5 and 7.0.2. The project’s development team implemented forced updates through the auto-update system for affected sites to mitigate risks. Cloudflare has also deployed detection rules to identify exploitation attempts and safeguard users who have not yet applied the patches.

CVE-2026-60137 is classified as a high-severity SQL injection flaw, while CVE-2026-63030 represents a critical arbitrary code execution vulnerability. Combining these two flaws enables attackers to achieve unauthenticated remote code execution on vulnerable WordPress installations.

Threat actors leveraging these vulnerabilities can gain control over targeted websites, potentially leading to data breaches or further malicious activities. Multiple cybersecurity firms have confirmed in-the-wild exploitation of the WP2Shell vulnerabilities. Patchstack, a WordPress security provider, verified active attacks, while Hexastrike reported detection of exploitation attempts in its honeypots over the weekend.

The company noted that it has already assisted with incident response for several affected organizations. Hexastrike provided guidance for identifying and analyzing intrusions linked to these vulnerabilities.

WatchTowr, another security firm, also observed active exploitation. Its CEO, Benjamin Harris, warned of the widespread impact, stating, “WordPress powers hundreds of millions of websites globally. While some sites may be auto-patched by hosting providers, many will remain unpatched, creating significant risk.”

Harris emphasized the accelerating timeline between vulnerability disclosure and exploitation, attributing this trend to AI-assisted tools. He noted that proof-of-concept code emerged within hours of the public announcement, contrasting with historical delays of 24 hours or more.

The rapid weaponization of these vulnerabilities underscores a broader shift in threat actor behavior, with attackers capitalizing on emerging flaws at an unprecedented pace. Security experts urge organizations to apply patches immediately and monitor for signs of compromise.

The vulnerabilities highlight the critical need for proactive security measures, particularly for widely used platforms like WordPress. As exploitation continues, the cybersecurity community remains vigilant in addressing the evolving threat landscape.