Two newly patched WordPress vulnerabilities are being actively exploited by attackers. Millions of websites that haven’t installed recent security updates face potential takeover. The attack chain, known as WP2Shell, enables hackers to execute malicious code on vulnerable sites without authentication.

Security firm WatchTowr has confirmed in-the-wild exploitation of these flaws. WordPress responded by releasing patches and enabling automatic security updates. However, researchers warn that millions of sites remain unprotected, creating an urgent situation for website owners.

Understanding the WP2Shell Attack Chain

The attack combines two distinct WordPress Core vulnerabilities. When used together, they allow complete website compromise without requiring login credentials. Security researcher Adam Kues from Searchlight Cyber discovered both flaws and named the exploit method WP2Shell.

The first vulnerability, CVE-2026-63030, carries a critical severity rating. This flaw exists in WordPress’s Batch REST API, causing the software to mishandle grouped API requests. As a result, WordPress applies incorrect security checks, allowing unauthorized access to restricted system areas.

The second flaw, CVE-2026-60137, enables SQL injection attacks and has a moderate severity rating. While each vulnerability poses risks independently, their combination creates a severe threat. Attackers can execute arbitrary shell commands on affected websites through this exploit chain.

Massive Scale of Exposure

Cybersecurity consultant Daniel Card estimates approximately 90 million websites face direct exposure to these exploits. Additionally, over 400 million sites run WordPress versions within the affected release ranges. While not all sites in this range are necessarily vulnerable, these numbers demonstrate the attack’s potential reach.

The situation is particularly serious because these vulnerabilities affect WordPress Core itself. Most previous high-profile WordPress attacks targeted third-party plugins. Even websites running clean, default WordPress installations without additional plugins could be compromised.

Why This Differs From Typical WordPress Attacks

Most WordPress security incidents involve vulnerable plugins that site owners install. However, CVE-2026-63030 and CVE-2026-60137 exist in the core WordPress software. This means standard installations without any plugins remain at risk.

Threat actors have become increasingly efficient at exploiting newly disclosed vulnerabilities. Attackers now weaponize security flaws within days or even hours after patches become available. This rapid exploitation makes immediate patching essential for website security.

Critical Importance of Rapid Security Updates

WordPress has released patches and enabled automatic updates for affected versions. Despite these measures, reports indicate widespread exploitation continues. Many site owners either haven’t received automatic updates or failed to manually install them.

Website administrators should verify their WordPress installation is current immediately. Setting up automatic updates provides the most reliable protection. When automatic updates aren’t feasible, implement monitoring systems that alert you when patches become available.

Organizations running critical production systems may want to test updates before deployment. Testing on non-production environments allows validation without risking operational systems. However, cybersecurity has become a race where execution speed often determines the outcome.

Best Practices for WordPress Security

Enable automatic security updates whenever possible. This ensures your site receives critical patches without delay. Additionally, implement monitoring systems that track your WordPress version and alert you to available updates.

Major technology companies have begun recommending three-day update windows for critical patches. Microsoft, for example, now urges customers to update devices within three days of patch releases. This timeline reflects the growing speed of exploit development and deployment.

Rapid patch management has become one of the most effective defenses against compromise. Organizations that treat security updates as urgent priorities significantly reduce their attack surface. Conversely, delayed patching creates windows of vulnerability that attackers actively exploit.

Taking Immediate Action

If your website runs WordPress, update your software without delay. Check your current WordPress version against the latest release. Install available updates immediately, even if this requires scheduling brief maintenance windows.

For sites with custom configurations or extensive plugin ecosystems, test updates in staging environments first. This approach balances security with operational stability. However, minimize the time between patch availability and production deployment.

The WP2Shell attack demonstrates that vulnerabilities in core software pose significant risks. Unlike plugin-based exploits that affect limited user bases, core vulnerabilities potentially impact hundreds of millions of websites. This scale makes rapid response essential for the entire WordPress ecosystem.

Original Source: www.techrepublic.com