'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover

A newly disclosed WordPress vulnerability chain dubbed "WP2Shell" is already being actively exploited in the wild — less than 72 hours after public disclosure — giving attackers remote shell access to millions of WordPress-powered websites.

The Vulnerability Chain

Security researchers have identified two critical vulnerabilities that attackers are chaining together for maximum impact:

• CVE-2026-60137 — A critical authentication bypass vulnerability affecting a widely-used WordPress component
• CVE-2026-63030 — A remote code execution (RCE) flaw that, when combined with CVE-2026-60137, allows unauthenticated attackers to execute arbitrary shell commands on vulnerable servers

Together, the exploit chain — nicknamed WP2Shell by researchers — enables a threat actor with no prior authentication or access to a target WordPress site to achieve full server compromise. This places it among the most severe vulnerability chains to hit the WordPress ecosystem in recent years.

Scale of Exposure

WordPress powers an estimated 43% of all websites on the internet, representing hundreds of millions of active sites globally. Even a fraction of unpatched deployments represents an attack surface of extraordinary scale.

The urgency is compounded by the speed of exploitation. Threat actors — ranging from automated scanning bots to organized criminal groups — began probing and exploiting vulnerable sites within days of the CVE disclosures, a pattern consistent with high-value WordPress vulnerabilities that attackers have pre-built tooling to exploit rapidly.

What Attackers Can Do

With remote shell access via WP2Shell, attackers can:

• Install web shells for persistent backdoor access
• Exfiltrate databases containing user credentials, personal data, and payment information
• Pivot to hosting infrastructure to attack other sites on shared servers
• Deploy malware or cryptominers on the compromised server
• Redirect visitors to malicious sites for phishing or malware distribution
• Deface websites for hacktivist or reputational damage purposes

Affected Systems

The vulnerability chain affects WordPress installations running specific versions of the affected components. Site administrators should immediately check WordPress, plugin, and theme versions against official security advisories from the WordPress Security Team and the affected component maintainers.

WordPress.org's automatic background update system will push patches to eligible sites automatically, but sites with auto-updates disabled — including many production environments where administrators prefer manual control — remain exposed until manually patched.

Immediate Mitigation Steps

WordPress site owners and administrators should take these steps immediately:

1. Update WordPress core to the latest version via the dashboard or WP-CLI
2. Update all plugins and themes — particularly those flagged in CVE-2026-60137 and CVE-2026-63030 advisories
3. Review server and access logs for signs of unauthorized shell access or unusual file creation
4. Enable a Web Application Firewall (WAF) — services like Cloudflare, Sucuri, or Wordfence can block known exploit patterns while patches are applied
5. Audit installed plugins and remove unused or abandoned plugins that expand attack surface
6. Verify file integrity using tools like Wordfence or manual comparison against known-good file hashes
7. Restrict PHP execution in upload directories via .htaccess or Nginx configuration to limit web shell persistence

Broader Implications

The WP2Shell chain highlights a persistent challenge in the WordPress ecosystem: the long tail of unpatched installations. Despite WordPress's built-in automatic update infrastructure, many sites — particularly those with custom configurations, staging environments, or administrator-managed update policies — remain on vulnerable versions for extended periods.

This creates a sustained window of opportunity for threat actors who move quickly after CVE disclosure. Security researchers have documented repeated patterns where WordPress vulnerabilities disclosed on a Monday are being exploited at scale by Wednesday.

Site owners running WordPress should treat patch management as an ongoing operational priority, not a periodic maintenance task. The alternative — as WP2Shell demonstrates — is participation in one of the internet's largest ongoing compromised server networks.