What happens if you visit a WordPress site hacked through wp2shell?

WordPress patched the critical "wp2shell" core vulnerability chain that enables unauthenticated remote code execution and full site takeover; attackers began exploiting the flaw within hours of the patch, injecting malicious JavaScript, redirects, and fake login prompts to steal credentials, deliver malware, and perpetrate scams. Site owners should patch immediately and users should exercise caution on compromised sites and consider browser-based protection such as Malwarebytes Browser Guard.