WP2Shell WordPress Flaws Exploited in the Wild; Patches Available
Summary
Two WP2Shell flaws enable unauthenticated remote code execution on affected WordPress sites. Multiple firms report exploitation; WordPress released patches and forced updates, while Cloudflare added protective rules.
Key points
- CVE-2026-60137 is a high-severity SQL injection flaw; CVE-2026-63030 is a critical arbitrary code execution flaw.
- Chaining the flaws can enable unauthenticated remote code execution on affected WordPress websites.
- WordPress versions 6.9.0–6.9.4 and 7.0.0–7.0.1 are affected, according to Searchlight Cyber.
- WordPress released versions 6.9.5 and 7.0.2 and enabled forced updates for affected installations.
- Cloudflare added rules to detect exploitation and protect customers who had not yet patched.
- Multiple cybersecurity firms report in-the-wild exploitation. Hexastrike observed attempts in honeypots and said it had assisted with incident response in several attacks.
- Public proof-of-concept exploits have appeared, although Searchlight Cyber has not released its own technical details.
Article Details
- Vulnerability Types
- SQL injection
- Arbitrary code execution
- Severity
- High for CVE-2026-60137; critical for CVE-2026-63030
- Affected Versions
- WordPress 6.9.0 through 6.9.4
- WordPress 7.0.0 through 7.0.1
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Update to WordPress 6.9.5 or 7.0.2.
- Use Cloudflare's rules to detect and protect against exploitation while installations are not yet patched.
MITRE ATT&CK
CVE
People
Vendors
CloudflareCloudflare has also rolled out rules to detect exploitation and protect customers whose installations were not immediately patched.HexastrikeHexastrike started seeing exploitation attempts in its honeypots over the weekend, and on Sunday the company said it had already assisted with incident response in several attacks.PatchstackOne of them is the WordPress security company Patchstack.Searchlight CyberAccording to Searchlight Cyber, whose researchers discovered the flaws, WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected.watchTowRWatchTowr has also seen in-the-wild exploitation attempts.WordPress.org“Due to the severity, the WordPress.org team have enabled forced updates via the auto-update system for sites running affected versions,” WordPress developers said.