# WP2Shell Vulnerabilities CVE-2026-60137 & CVE-2026-63030 Exploited

> WordPress sites face active exploitation via WP2Shell vulnerabilities CVE-2026-60137 and CVE-2026-63030. Learn the technical details and mitigation steps.

- Published: 2026-07-20T06:49:53.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: Wp2shell, WordPress, CVE-2026-60137, CVE-2026-63030, RCE, Active Exploitation
- Author: Runtime Rebel Intel
- Primary source: https://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/
- Canonical: https://runtimerebel.com/blog/wp2shell-vulnerabilities-cve-2026-60137-cve-2026-63030-exploited

## Key points

- Immediate impact: Threat actors are actively exploiting WP2Shell vulnerabilities to deploy web shells and gain persistent administrative access to WordPress environments.
- Affected systems: WordPress installations utilizing the WP2Shell plugin or script components identified under CVE-2026-60137 and CVE-2026-63030 are at risk.
- Remediation: Administrators should immediately update all WordPress plugins, remove unauthorized WP2Shell components, and audit server logs for suspicious PHP executions.

The WordPress security ecosystem is currently confronting an active wave of attacks targeting vulnerabilities in the WP2Shell component. According to [SecurityWeek](https://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/), exploitation of the [CVE](/glossary#cve) tracked as [CVE-2026-60137](/cve/cve-2026-60137) and [CVE-2026-63030](/cve/cve-2026-63030) commenced shortly after technical details were disclosed to the public. These flaws allow attackers to bypass standard security controls and establish a foothold on the server, often leading to full site takeover.

## Technical Analysis of WP2Shell Exploitation

The WP2Shell tool is frequently associated with administrative shell access, but when vulnerabilities exist within such powerful scripts, the impact is severe. These specific flaws allow for unauthenticated [RCE](/glossary#rce), meaning an attacker does not require a valid login to execute commands on the target system. The [TTP](/glossary#ttp) observed in the wild involves the delivery of malicious PHP payloads through vulnerable endpoints, effectively bypassing the WordPress authentication layer.

Because these attacks are occurring in the wild, the [SOC](/glossary#soc) must prioritize the identification of anomalous web requests. Security researchers have noted that the exploitation window is shrinking; threat actors are now leveraging automated scanners to identify vulnerable targets within hours of a [Zero-Day](/glossary#zero-day) or newly disclosed vulnerability being announced. This rapid weaponization highlights the need for automated [EDR](/glossary#edr) and WAF rules to block known exploit strings.

### How to Detect CVE-2026-60137 Exploit Attempts

To identify potential compromise, defenders should examine their web server access logs for requests directed at the WP2Shell plugin directory or associated standalone scripts. Understanding how to detect CVE-2026-60137 exploit attempts involves looking for POST requests to unusual PHP files that do not belong to the core WordPress installation. High-frequency requests to `/wp-content/plugins/` with encoded parameters are a common [IoC](/glossary#ioc) for this activity.

Furthermore, monitoring for the creation of new administrative users or the modification of `header.php` and `footer.php` files within the active theme can reveal successful exploitation. Attackers often use these vulnerabilities to perform [Privilege Escalation](/glossary#privilege-escalation), moving from a limited web user to a full administrator to install further backdoors.

## WordPress CVE-2026-63030 Mitigation and Defense

Defenders should implement a comprehensive strategy for WordPress CVE-2026-63030 mitigation to protect their digital assets. The primary defense is the immediate removal of the WP2Shell plugin if it is not business-critical, or updating it to a version where the vendor has verified the patch. If a patch is unavailable, the plugin should be deactivated and deleted entirely.

### WP2Shell Vulnerability Patch Guidance

Beyond simple updates, following WP2Shell vulnerability patch guidance requires a multi-layered approach:

*   **File Permissions:** Harden file permissions on the server to prevent the web server user from writing to sensitive directories like `/wp-includes/` and the root directory.
*   **Log Aggregation:** Ensure that all web server logs are being ingested into a [SIEM](/glossary#siem) for real-time analysis and alerting on suspicious activity.
*   **Ingress Filtering:** Use a Web Application Firewall (WAF) to filter out common shell-related commands such as `base64_decode`, `eval`, and `system` within incoming HTTP requests.

Applying [Zero Trust](/glossary#zero-trust) principles to plugin management can significantly reduce the attack surface. Every plugin installed increases the risk of [Supply Chain Attack](/glossary#supply-chain-attack) vectors or direct vulnerabilities. Regularly auditing the plugin list and removing unused code is an effective way to lower the [CVSS](/glossary#cvss) profile of the entire organization.

**Related:** [WordPress Core RCE wp2shell: Versions 6.9 and 7.0 Vulnerable](/blog/wordpress-core-rce-wp2shell-versions-6-9-and-7-0-vulnerable), [WordPress wp2shell RCE: Public Exploits Released for Core Flaws](/blog/wordpress-wp2shell-rce-public-exploits-released-for-core-flaws)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/wp2shell-vulnerabilities-cve-2026-60137-cve-2026-63030-exploited