WP2Shell chains two WordPress flaws into admin and web-shell access
Seqrite’s proof of concept uses CVE-2026-63030 and CVE-2026-60137 but does not show widespread live exploitation.
Stories per day · 30 days
2 RSS
Relatedrest-api3sql-injection3wordpress3cve-2026-601371cve-2026-630301poc1rce1unauthenticated1web-shell1
7 stories, newest first · one card per story
Stories tagged #wp2shell
Chained WordPress flaws allow unauthenticated site takeover
WP2Shell chains CVE-2026-63030 and CVE-2026-60137; fixes are 6.8.6, 6.9.5 and 7.0.2.
Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication
Seqrite details WP2Shell, an unauthenticated WordPress chain combining two core flaws into remote code execution.
TIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft Attacks
TIKTOUK harvests exposed WordPress files and JavaScript to steal SMTP, AWS, and API credentials.
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
A Chinese-linked actor exploited WordPress and Zyxel flaws, stealing government records from dozens of organizations.
wp2shell: incident response guide (CVE-2026-63030 + CVE-2026-60137)
Eye Security published forensic IR tooling for wp2shell (CVE-2026-63030/CVE-2026-60137), the unauthenticated WordPress core RCE chain, after WordPress.org forced auto-updates.
5
WordPress wp2shell Vulnerabilities Exploited in the Wild (CVE-2026 ...
Public exploit code emerged for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137); CISA set a July 24 patching deadline.