WP2Shell: Two WordPress Flaws Are Being Exploited Right Now, and Millions of Sites Are at Risk
A pair of newly patched security holes in WordPress are already being used in live attacks. No login required. No special setup needed. Just a vulnerable website.
Key points
- Two WordPress security flaws, tracked as CVE-2026-60137 and CVE-2026-63030, are being actively exploited as of this weekend.
- Affected WordPress versions span 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, with patches released Friday in versions 6.9.5 and 7.0.2.
- An attacker needs no account and no special configuration to exploit either flaw on a standard WordPress site.
- WordPress has forced automatic updates to patched versions for sites still running the vulnerable software.
- Working exploit code appeared publicly within hours of the vulnerabilities being disclosed, collapsing the usual window between discovery and attack.
Two newly patched security flaws in WordPress are being used in real attacks right now. Researchers have named the pair "WP2Shell," shorthand for what they ultimately let an attacker do: gain shell access, meaning full remote control over a web server.
Discovered by Searchlight Cyber, CVE-2026-60137 is a SQL injection bug, where a criminal sends specially crafted text to a site's database to extract or manipulate data. CVE-2026-63030 is an arbitrary code execution vulnerability, meaning an attacker can run any software they choose on the target server. Chain them together and you get unauthenticated remote code execution: a complete takeover, no password required.
How did the hackers get in?
They didn't need stolen credentials. The attack works against a plain, out-of-the-box WordPress installation with no added plugins, on any site still running versions 6.9.0 to 6.9.4 or 7.0.0 to 7.0.1. Anyone on the internet can attempt it anonymously.
Searchlight Cyber withheld technical details to limit abuse. That caution came too late. Working exploit code appeared publicly within hours of disclosure. WatchTowr CEO Benjamin Harris, speaking to SecurityWeek, put the timeline in context: "We saw PoCs appear within hours of disclosure, where historically that would have taken 24 hours or more. The window between disclosure and exploitation has collapsed, and WordPress is simply today's reminder of it."
Patchstack and WatchTowr have both confirmed live exploitation attempts. Hexastrike spotted attacks in its honeypots over the weekend and by Sunday had already helped clean up several compromised sites.
As we reported on 17 July, every WordPress 6.9 and 7.0 site was exposed until Friday's emergency patch, which WordPress is force-installing via its auto-update system. Web infrastructure company Cloudflare has also deployed detection rules to block known attack patterns for its customers.
Should you worry?
If you run a WordPress site, check today that your version number reads 6.9.5 or 7.0.2. If your host manages updates, confirm automatic updates are on. Any site that ran a vulnerable version over the past several days should be treated as potentially compromised: ask your host or a security professional to review it.
Harris was blunt: "WordPress runs on hundreds of millions of websites globally. Some of those will be auto-patched by their hosting providers, but plenty will not, and that is where the damage will be done."
Ordinary visitors to affected sites could have had personal data exposed or been redirected to malicious pages without warning. If a site you use recently showed unexpected redirects or strange pop-ups, report it to the site owner.
The pattern here is worth watching. This isn't the first time a CMS core vulnerability has outpaced defenders; it won't be the last. The real story is the speed: when exploit code ships within hours, forced auto-updates aren't a courtesy, they're the only thing standing between a patch and a mass compromise.
