wp2shell: mass exploitation of unpatched WordPress servers underway

Attackers have started exploiting the WordPress flaw chain dubbed wp2shell at scale. Honeypots run by security firm watchTowr have logged tens of thousands of exploitation attempts, so far traced to 13 IP addresses across seven countries. The chain links two bugs: CVE-2026-60137, a route-confusion issue in the REST API batch endpoint that bypasses authentication, and CVE-2026-63030, which turns that into unauthenticated remote code execution. WordPress 6.9.0 through 6.9.4 plus 7.0.0 and 7.0.1 are affected; versions 6.9.5 and 7.0.2 have carried the fix since July 17.

The exploit works against default installations as long as no persistent object cache is configured. Data from Wiz hints at the size of the target pool: about 60 percent of organizations running WordPress recently had vulnerable instances, and a quarter of those sat exposed on the open internet.

Self-hosters should verify the update landed — and then inspect the site itself. New admin accounts, unfamiliar plugins or odd files point to a compromise that predates the patch.