Hackers Race to Break Into WordPress Sites Through 'wp2shell' Flaws

Key points

• WordPress patched two critical flaws, CVE-2026-63030 and CVE-2026-60137, in versions 7.0.2, 6.9.5 and 6.8.6, and pushed automatic updates to supported sites.
• Attackers do not need to log in to exploit the bugs, together nicknamed wp2shell, and can run their own code on a vulnerable site.
• Security firm Defiant recorded the first probing at 23:29 UTC on July 17, followed by a real SQL injection attempt 13 minutes later.
• A live tracker run by Macnica researcher Yutaka Sejiyama puts the patch rate at 81.6% across a sample of 124,580 sites, meaning close to 23,000 in that sample are still unpatched.
• Cloud security firm Wiz has seen attackers installing fake plugins, planting hidden backdoors and pulling admin usernames and emails from live sites.

Criminals are actively breaking into WordPress websites through a pair of serious flaws in the software that powers a large slice of the internet.

The two bugs, tracked as CVE-2026-63030 and CVE-2026-60137, have been chained together into an attack researchers are calling wp2shell. The name is a nod to what it does: turn any vulnerable WordPress site into a shell, meaning a remote command line the attacker fully controls.

The flaw sits in the WordPress REST API, the built-in system a site uses to talk to plugins and outside apps. A feature called batch processing, which lets several requests run at once, can be abused to run attacker code without ever logging in. That last part is what makes this so dangerous. No stolen password required.

WordPress fixed the problem in versions 7.0.2, 6.9.5 and 6.8.6, and force-pushed automatic security updates. The bug was first disclosed by threat intelligence company SearchLight Cyber. Working exploit code appeared publicly over the weekend that followed.

What are the hackers actually doing once they get in?

They are planting backdoors and taking over admin accounts.

Cloud security company Wiz has been watching the attacks and lists a familiar playbook. Mass scans across the internet looking for sites that have not been patched. Abuse of the plugin upload feature to install malicious add-ons. Deployment of PHP webshells, small hidden scripts that let an attacker send commands to the site whenever they like. Some are one-liner backdoors, others are dressed up to look like a legitimate plugin.

Wiz also saw attackers query the REST API to hoover up administrator usernames and email addresses, and try to read wp-config, the file that holds a site's database password and secret keys.

Johannes B. Ullrich, Dean of Research at SANS Technology Institute, has documented a two-stage version of the attack. First a light SQL injection probe to confirm the site is vulnerable, then a PHP webshell dropped into the /wp-content/cache/ folder. Visit the shell in a browser and it returns a fake "404 not found" page, hiding it from a casual look.

Ullrich also reports attackers creating brand new administrator accounts, giving them a way back in even if the webshell is later deleted.

BleepingComputer, which first flagged the wave of exploitation, noted the speed involved: WordPress security firm Defiant clocked the first probing at 23:29 UTC on July 17 and a real SQL injection 13 minutes later.

What should site owners do right now?

Update, then hunt.

If your site runs a supported version of WordPress, the automatic update should already have landed. Confirm you are on 7.0.2, 6.9.5 or 6.8.6, whichever branch you use. Older or heavily customised sites that block auto-updates need a manual push today, not next week.

After patching, treat the site as possibly already broken into. Check the /wp-content/cache/ folder for PHP files that should not be there. List your administrator accounts and delete any you do not recognise. Look through your installed plugins for anything you did not add yourself. Review web server logs for suspicious requests to admin-ajax.php or the REST API around and after July 17.

Wiz says it has not yet seen attackers moving deeper into networks or stealing large amounts of data. That does not mean it is not happening. It means the cleanup window is now.