CRITICALVulnerability
Global

Critical wp2shell WordPress flaws exploited to install webshells

·Source: BleepingComputer

Updated:

Executive Summary

Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. [...]

Analysis

Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. [...]

Indicators of Compromise (2)

CVE (2)
CVE-2026-63030
NVDMITRE CVE
CVE-2026-60137
NVDMITRE CVE
Source Attribution

Originally published by BleepingComputer on Jul 21, 2026.

Related Threats

MEDIUMVulnerabilityNEW

French Parliament greenlights social media ban for under-15s

Both houses of the French Parliament voted to block social media access for children under 15, making France the first European country to enact a ban amid a broadening global crackdown.

The Record
MEDIUMVulnerability

Rondo Meets Geoserver, (Wed, Jul 22nd)

This isn&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;t a new attack, but something I saw "pop-up" in our logs this week:

SANS ISC
MEDIUMVulnerability

Pixels Tracking Every Loan You Take on EU Bank Websites

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/pixels-tracking-every-loan-you-take-on-eu-bank-websites-image_small-2-a-32296.jpg" align=right hspace=4><b>Jscrambler Detects Cookies Exporting Detailed View of Customer Financial Intent</b><br>Many European and American bank websites are quietly - and perhaps unwittingly - sending sensitive customer data to third parties such as

Bank Info Security