2026 WordPress “wp2shell” exploitation

Morgan Nwaiku@sir_morganzee

•updated Aug 14, 2026•16•0•30

Attackers began actively exploiting CVE-2026-63030 and CVE-2026-60137 in WordPress Core in July 2026. The vulnerabilities involve the WordPress REST API batch-processing functionality and were used to deploy persistent web shells and malicious plugins. WordPress subsequently released fixes in versions 7.0.2, 6.9.5 and 6.8.6.