WP2Shell chains two WordPress flaws into admin and web-shell access
Seqrite’s proof of concept uses CVE-2026-63030 and CVE-2026-60137 but does not show widespread live exploitation.
74
Malware
wp2shell
- Mentions · 7d0
- Mentions · 30d1
- All mentions3
- First seenSep 22, 2026
- Last mentioned22d ago
Timeline
3 articles · newest firstRussian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure
CyberXero used WordPress exploits and Claude agents against Ukrainian energy targets, stealing hundreds of thousands of records.
84
Hackers Exploit WordPress Flaws to Steal 18,566 Government Records and Plaintext Passwords
Chinese-speaking actor exploited WordPress flaws affecting 49 orgs, stealing 18,566 government records including plaintext passwords.
80
Related CVEs
by mentions- CVE-2026-6303011%9.8WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
- CVE-2026-601375%5.9WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)
- CVE-2026-4815<1%8.7A SQL Injection vulnerability has been found in Support Board v3.7.7
Appears with
- WordPressproduct · 2
- ZyXEL GS1900product · 1
- GreyNoiseorganization · 1
- SOCRadarorganization · 1
- Claudeai model · 1
- PentAGIproduct · 1
- Cobalt Strikemalware · 1
- 49 organizations across 29 countriesvictim · 1
- Seqriteorganization · 1
- WSOmalware · 1
- ZyXELvendor · 1
- Magentoproduct · 1
- CyberXerothreat actor · 1
- Claude Codeproduct · 1
- Support Boardproduct · 1
- western governmentvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.