WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

Two critical WordPress flaws (CVE-2026-63030 and CVE-2026-60137), collectively dubbed wp2shell, are being actively exploited in the wild to achieve unauthenticated RCE on stock WordPress installations; attackers have used public PoC code and AI-assisted development to scale scans and compromises, deploying malicious plugins, web shells (including a 150 KB CMSmap-like shell), creating backdoor admin accounts, and attempting to install RATs. Telemetry from multiple vendors shows widespread scanning and exploitation across many countries, with defenders urged to patch immediately and hunt for indicators of compromise even after applying fixes.