Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication
Seqrite details WP2Shell, an unauthenticated WordPress chain combining two core flaws into remote code execution.
Stories per day · 30 days
3 RSS
12 stories, newest first · one card per story
Stories tagged #cve-2026-63030
Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data
A Chinese threat actor exploited critical WordPress vulnerabilities to steal 18,566 sensitive records from a Western government organization across 29 countries.
5
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation
GreyNoise tracks 'Red Heron' actor exploiting multiple vulnerabilities including novel ZyXEL CVE-2026-7273 and stealing 18,000+ government records.
Don’t swing at everything
2
WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning
4
Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
3
U.S. CISA adds DD-WRT, Langflow and WordPress flaws to its Known Exploited Vulnerabilities catalog
1
Two new high severity WordPress vulnerabilities, patch immediately!
6
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0
2
Researchers Build WordPress Exploit Using OpenAI's GPT
2
Attackers Can Take Over WordPress Sites Using Newly Released wp2shell Exploits
1
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
2