SECURITYJul 20 · 21:38 UTCDARK READINGJai Vijayan

'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover

A new vulnerability called 'WP2Shell' has been discovered in WordPress, allowing remote takeover. Attackers are actively exploiting CVE-2026-60137 and CVE-2026-63030 to target millions of sites.

Nexus surfaces and summarizes. The full story lives at the source.

Mentioned

wp2shelltopicCVE-2026-60137topicCVE-2026-63030topicWordPressorganization

Spot something wrong with this article?Report a problem →

Forward this

Related Signal

Adjacent reporting

SECURITYJul 18 · 17:22 UTC
WordPress Core "wp2shell" RCE flaws get public exploits, patch now
SECURITYJul 17 · 21:20 UTC
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
SECURITYJun 6 · 14:09 UTC
Critical Everest Forms Pro flaw exploited to take over WordPress sites
SECURITYMay 21 · 03:44 UTC
Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacks
SECURITYJun 5 · 08:38 UTC
Hackers Exploit Critical Everest Forms Pro WordPress Plugin Flaw to Take Over Sites