Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication
Seqrite details WP2Shell, an unauthenticated WordPress chain combining two core flaws into remote code execution.
Stories per day · 30 days
12 stories, newest first · one card per story
Stories tagged #cve-2026-60137
TIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft Attacks
TIKTOUK harvests exposed WordPress files and JavaScript to steal SMTP, AWS, and API credentials.
Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data
A Chinese threat actor exploited critical WordPress vulnerabilities to steal 18,566 sensitive records from a Western government organization across 29 countries.
5
Don’t swing at everything
2
WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning
4
Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
3
U.S. CISA adds DD-WRT, Langflow and WordPress flaws to its Known Exploited Vulnerabilities catalog
1
Two new high severity WordPress vulnerabilities, patch immediately!
6
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0
2
Researchers Build WordPress Exploit Using OpenAI's GPT
2
Attackers Can Take Over WordPress Sites Using Newly Released wp2shell Exploits
1
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
2