WordPress WP2Shell CVEs Under Active Exploitation: Rapid Weaponisation Following Public Disclosure

Two previously undisclosed WordPress vulnerabilities tracked as CVE-2026-60137 and CVE-2026-63030 are now subject to active exploitation in the wild. The timeline between public disclosure and weaponised attacks is notably compressed, indicating either coordinated threat actor activity or broad scanning infrastructure already probing for the flaws before patches were available. This pattern is consistent with WordPress's position as a high-volume target across millions of internet-facing installations, many running outdated or unpatched codebases.

The technical details available from the source are limited, but the "WP2Shell" designation suggests these vulnerabilities likely enable shell access or remote code execution on affected systems. This would classify them as critical from an attacker perspective, enabling full system compromise. The rapid exploitation suggests the attack is not surgically targeted but rather part of automated scanning and exploitation infrastructure designed to compromise as many WordPress installations as possible.

WordPress site operators face immediate risk, particularly those running automatic updates disabled or those managing sites across multiple installations without centralised patch management. Hosting providers and managed WordPress platforms likely activated emergency mitigations quickly, but self-hosted and legacy installations remain exposed. The compressed exploitation window means defenders had minimal time between disclosure and active attacks to apply patches.

Defenders should: prioritise patching all WordPress installations to the latest version containing fixes for both CVEs; enable automatic security updates where operationally feasible; implement Web Application Firewall (WAF) rules blocking exploitation attempts if patching is delayed; and audit logs for signs of compromise from the disclosure date onwards. Sites with dedicated security tooling should monitor for file creation or shell activity consistent with post-exploitation activity.

This incident reinforces the persistent vulnerability of WordPress as a monoculture target. The large installed base, wide variance in patch deployment timelines, and accessibility of WordPress documentation make it an efficient hunting ground for threat actors. Future security hardening should focus on reducing the disclosure-to-patch window for site operators through improved update delivery and communication channels.