WP2Shell: Two WordPress Flaws Let Attackers Take Over Websites Without Logging In
Criminals are actively exploiting a pair of newly discovered security holes in WordPress to seize full control of websites. Tens of millions of sites were at risk, and patching may already be too late for some.
Key points
- Attackers began mass-exploiting two WordPress vulnerabilities, CVE-2026-60137 and CVE-2026-63030, within hours of their public disclosure on 17 July 2026.
- WordPress issued a security update on 17 July 2026 and enabled forced automatic updates for all affected sites running versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1.
- Security firm watchTowr recorded tens of thousands of exploitation attempts and more than 100 backdoor administrator accounts created by different criminal groups within roughly 48 hours.
- Researchers at Searchlight Cyber used an AI model to find both flaws and build a working attack in 10 hours, raising sharp questions about AI-assisted hacking.
- Any site owner who has not yet patched should immediately check for new administrator accounts or unfamiliar plugins, even if they believe the update has applied.
Criminals are breaking into WordPress websites at scale using a two-flaw combination that security researchers are calling WP2Shell. WordPress is the software that powers an estimated 40 percent of all websites on the internet, from small blogs to large news outlets.
The first flaw, CVE-2026-60137, is what security researchers call an SQL injection vulnerability. SQL (Structured Query Language) is the language websites use to talk to their databases. An SQL injection flaw lets an attacker send specially crafted instructions that trick the database into handing over data it should keep private, including password records.
On its own, that flaw required a valid login to exploit. The second flaw changed everything.
How did the attackers get in without a password?
The second flaw, CVE-2026-63030, sits in a feature called the Batch REST API, a tool that lets software send several requests to a website in a single bundle. A logic error in this feature means the website checks whether a request is legitimate, then executes a slightly different version of that request, one it never actually checked. Attackers learned to slip a malicious instruction through that gap.
Combined, the two flaws let a complete stranger, with no account and no stolen password, send a single anonymous request to a standard WordPress installation and gain the ability to run any code they choose on the server. Security researchers call that remote code execution, or RCE.
WatchTowr, a security monitoring company, detected active attacks by the early hours of Saturday 19 July 2026 using its honeypot network, a system of decoy websites designed to attract and record criminal activity. Attackers first used the flaw to steal hashed credentials (scrambled versions of passwords) and then pushed what are known as Remote Access Trojans onto compromised servers. A Remote Access Trojan, or RAT, is a program that gives criminals ongoing hidden control over a machine. WatchTowr observed attempts to install a specific RAT called Overlord, built in a programming language called Golang.
VulnCheck verified more than two dozen ready-to-run exploit scripts targeting WP2Shell by 19 July, barely two days after the flaws were first disclosed publicly.
WordPress pushed a forced automatic update on 17 July 2026 to all sites running vulnerable versions. However, watchTowr principal researcher Jake Knott warned that patching alone is not enough: any site that was exposed before the update arrived may already carry a hidden backdoor account or a malicious plugin installed by attackers.
What website owners and administrators should do right now:
- Log into your WordPress dashboard and check the Users section for any administrator accounts you do not recognise. Delete them immediately.
- Go to Plugins and remove any plugin you did not install yourself or cannot identify.
- Check that your WordPress version shows 7.0.2 or later under Dashboard, then Updates.
- If you run a site for customers or collect any personal data, consider notifying your legal or compliance team so they can assess whether a data-breach report to a regulator (such as the ICO in the UK or the FTC in the United States) is required.
