Two critical WordPress vulnerabilities are under active exploitation, with attackers targeting websites shortly after the security flaws became public. The vulnerabilities, collectively known as WP2Shell, are officially designated as CVE-2026-60137 and CVE-2026-63030.

Researchers at Searchlight Cyber discovered the flaws affecting WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The security firm emphasized the severity of the issue, noting that anonymous users can exploit these WordPress vulnerabilities on stock installations without any plugins installed.

Emergency Patches and Automatic Updates Deployed

WordPress released patches on Friday with versions 6.9.5 and 7.0.2. Due to the critical nature of these WordPress vulnerabilities, the WordPress.org team activated forced updates through the auto-update system for affected installations. Therefore, many sites received automatic protection without administrator intervention.

Additionally, Cloudflare implemented detection rules to protect customers whose installations have not yet been patched. This multi-layered response demonstrates the industry’s recognition of the threat’s severity.

Understanding the WP2Shell Attack Chain

CVE-2026-60137 represents a high-severity SQL injection vulnerability. Meanwhile, CVE-2026-63030 is classified as a critical arbitrary code execution flaw. When attackers chain these two WordPress vulnerabilities together, they achieve unauthenticated remote code execution on targeted websites.

This combination enables threat actors to take complete control of vulnerable WordPress installations. The attack requires no preconditions, making it particularly dangerous for unpatched systems. Consequently, the potential impact extends to hundreds of millions of websites globally.

Exploitation Confirmed Across Multiple Security Platforms

Several cybersecurity firms have confirmed active exploitation of the WP2Shell vulnerabilities. Patchstack, a WordPress security company, detected exploitation attempts shortly after disclosure. Similarly, Hexastrike observed attacks in its honeypots over the weekend.

By Sunday, Hexastrike had already assisted with incident response for several compromised websites. The company shared recommendations for detecting and investigating intrusions. WatchTowr also reported witnessing exploitation attempts in the wild.

Rapid Weaponization Timeline

Benjamin Harris, CEO and founder of WatchTowr, warned that this incident will have significant consequences. He noted that while some websites benefit from automatic patching by hosting providers, many others remain vulnerable. Harris emphasized the concerning trend of AI-assisted vulnerability discovery.

Proof-of-concept exploits appeared within hours of disclosure, compared to the historical timeframe of 24 hours or more. This accelerated timeline reflects how quickly attackers can now weaponize newly discovered WordPress vulnerabilities. The window between disclosure and active exploitation has collapsed dramatically.

Scope and Impact of the Vulnerabilities

WordPress powers hundreds of millions of websites worldwide. Therefore, the WP2Shell vulnerabilities present a substantial security risk across the internet. Although Searchlight Cyber withheld technical details to prevent widespread abuse, others have published proof-of-concept exploits.

The availability of these exploits has accelerated the threat landscape. Security teams must prioritize patching efforts to protect their WordPress installations. Organizations running affected versions should verify that automatic updates have been applied successfully.

Industry Response and Protection Measures

The cybersecurity community has mobilized quickly to address these WordPress vulnerabilities. Security firms have deployed detection mechanisms and monitoring tools. Hosting providers are implementing additional protective measures for their customers.

Organizations should implement several defensive strategies. First, verify that WordPress installations have updated to version 6.9.5 or 7.0.2. Second, review server logs for suspicious activity or unauthorized access attempts. Third, conduct security audits to identify any potential compromises.

AI-Assisted Vulnerability Discovery Trends

This incident highlights an emerging pattern in vulnerability research. AI-assisted tooling is increasingly identifying security flaws in popular software platforms. This technology has fundamentally changed how the industry discovers and responds to vulnerabilities.

However, the same tools that help security researchers also enable attackers to develop exploits more rapidly. The democratization of vulnerability analysis has compressed the time between discovery and exploitation. Organizations must adapt their security strategies to account for this accelerated threat timeline.

Recommendations for WordPress Administrators

Website administrators should take immediate action to protect their installations. First, confirm that WordPress has updated to the latest patched version. Additionally, review user accounts for unauthorized additions or privilege escalations.

Organizations should monitor their WordPress installations for signs of compromise. Look for unexpected file modifications, new administrative users, or suspicious database queries. Furthermore, implement web application firewalls to provide an additional layer of protection.

Regular security audits become increasingly important as exploitation windows shrink. Therefore, organizations should establish processes for rapid patch deployment. This includes testing update procedures and maintaining current backup strategies.

Original Source: www.securityweek.com