SecurityBleepingComputerabout 3 hours ago
Critical wp2shell WordPress flaws exploited to install webshells
1 min read
Hackers are mass-exploiting two WordPress Core flaws, dubbed wp2shell, to install webshells and create rogue admin accounts. The critical chain (CVE-2026-63030 and CVE-2026-60137) combines a SQL injection and a REST API route confusion bug, allowing unauthenticated remote code execution. Researcher Adam Kues used OpenAI's GPT-5.6 to develop the exploit in about 10 hours.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
