Massive WordPress 'wp2shell' Vulnerability Under Active Exploitation, Threatening Millions of Websites

An unprecedented wave of attacks is currently exploiting two recently patched, critical vulnerabilities in WordPress core, collectively dubbed "wp2shell," allowing hackers to remotely take over millions of websites without any prior authentication or special preconditions. Discovered by security researchers at Searchlight Cyber, notably Adam Kues, these flaws, tracked as CVE-2026-60137 and CVE-2026-63030, represent a pre-authentication remote code execution (RCE) chain that impacts WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The SQL injection vulnerability (CVE-2026-60137) alone extends its reach to versions as far back as WordPress 6.8.0, though the full RCE chain requires the REST API batch-route confusion (CVE-2026-63030) introduced in version 6.9. The WordPress Security Team released emergency patches on July 17, 2026, with versions 6.9.5, 7.0.2, and 6.8.6 addressing these issues, and initiated forced automatic updates for affected installations due to the severity. However, despite these efforts, public proof-of-concept (PoC) exploits have quickly emerged, and multiple cybersecurity firms, including Patchstack and Hexastrike, have confirmed active exploitation in the wild, with attacks commencing almost immediately after disclosure. Searchlight Cyber estimates that over 500 million websites utilize WordPress, making the potential scale of compromise staggering.

This "wp2shell" vulnerability chain is a profoundly significant event because it bypasses the typical security layers and user interactions often required for website compromise. The ability for an anonymous attacker to execute code on a default WordPress installation, without needing any plugins or special configurations, simplifies the attack vector dramatically. This directly threatens the estimated 41.5% of all websites powered by WordPress as of July 2026, including critical e-commerce platforms, small business sites, and personal blogs. The impact on users and businesses extends far beyond mere defacement; successful exploitation can lead to complete website compromise, sensitive data exposure, financial losses, and severe reputational damage. Data breaches, for instance, cost an average of $4.44 million globally and a record $10.22 million in the United States. Furthermore, compromised sites often face SEO penalties from search engines and can be used to host phishing pages or spread malware, leading to prolonged recovery times and potential loss of customer trust. The speed of exploitation is also a critical factor; for heavily targeted vulnerabilities, the weighted median time from public disclosure to mass exploitation is a mere five hours, a timeline many organizations struggle to meet. This rapid weaponization puts immense pressure on website administrators and hosting providers to patch immediately and verify update success, as automatic updates can sometimes fail or be delayed.

Historically, the vast majority of WordPress vulnerabilities (91% in 2025) have been found in third-party plugins and themes, rather than the core software itself. WordPress core has generally maintained a reputation for being relatively secure, with a dedicated security team that responds swiftly to reported issues. This makes a core RCE vulnerability of "wp2shell's" magnitude a rare and alarming departure from the norm. While other popular Content Management Systems (CMS) like Drupal and Joomla also face their share of security challenges, often stemming from extensions, their core architectures or smaller market shares sometimes present different risk profiles. For instance, Drupal is often lauded for its robust security features and more formal security advisory process, making it a preferred choice for enterprise-level applications with stringent security requirements. However, WordPress's sheer ubiquity makes it an unparalleled target, with attackers constantly probing its default paths and common plugin structures. The "wp2shell" flaw underscores that even the most secure core can be susceptible, and when it is, the consequences are magnified by WordPress's massive footprint. This incident contrasts sharply with more common, yet still dangerous, attacks like the WP-SHELLSTORM operation observed in June 2026, which exploited out-of-date caching plugin flaws to backdoor thousands of sites.

Looking ahead, the active exploitation of "wp2shell" signals an intensified phase in the ongoing cybersecurity cat-and-mouse game. The immediate imperative for all WordPress site owners is to confirm that their installations have been successfully updated to versions 6.9.5, 7.0.2, or 6.8.6, and to implement robust monitoring for suspicious activity, particularly requests hitting the affected REST API batch endpoints. Cloudflare and other security providers have already rolled out Web Application Firewall (WAF) rules to help protect unpatched sites, but these are temporary mitigations, not substitutes for patching. Beyond immediate fixes, this incident will likely prompt a deeper re-evaluation of security practices within the WordPress ecosystem. The increasing sophistication of attackers, coupled with the potential for AI-driven scripts to accelerate vulnerability discovery and mass exploitation, means that proactive defense is more critical than ever. Site administrators should prioritize reducing feature bloat by auditing and removing unnecessary plugins to minimize their attack surface. Furthermore, the upcoming implementation of the European Union's Cyber Resilience Act (CRA) in September 2026, which mandates developers to notify authorities about actively exploited or severe vulnerabilities, will exert additional pressure on open-source projects to enhance transparency and accelerate patch delivery. This incident serves as a stark reminder that in the interconnected digital landscape, continuous vigilance and rapid response remain the bedrock of website security.