Cybercriminals began exploiting two critical WordPress vulnerabilities almost immediately. The combination of these security flaws allows complete control of a vulnerable website without logging in. According to SecurityWeek, security firms reported detecting the first attacks within just a few hours of the disclosure.
The impact could be significant. According to official WordPress statistics, at the time the security updates were released, more than 400 million websites were still running a vulnerable version of the content management system. That number has likely decreased since then, as many systems have been automatically updated, but security researcher Daniel Card estimates, based on a sample of approximately 3,500 websites, that less than 15 percent remain vulnerable. According to TechCrunch, that would amount to roughly 90 million websites.
The vulnerabilities, collectively known as WP2Shell, have been assigned CVE-2026-60137 and CVE-2026-63030. According to researchers at Searchlight Cyber, the vulnerabilities affect WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The company states that even a standard WordPress installation without any additional plugins can be vulnerable.
WordPress released security updates on Friday in versions 6.9.5 and 7.0.2. Due to the severity of the situation, vulnerable installations that support automatic updates must update. Cloudflare has also activated additional detection rules to protect customers who have not yet installed an update.
Two vulnerabilities together form an attack chain
The first vulnerability, CVE-2026-60137, is an SQL injection vulnerability. The second, CVE-2026-63030, allows arbitrary code execution. On their own, both vulnerabilities are already severe, but when combined, attackers can remotely execute code on a WordPress server without any form of authentication. This enables them, among other things, to deploy malware, modify files, or take over the entire website.
Searchlight Cyber deliberately chose not to disclose technical details to limit exploitation. Nevertheless, proof-of-concept exploits from other researchers appeared shortly after the disclosure. This significantly lowered the barrier to entry for attackers.
Exploitation gained momentum quickly
Several security firms have confirmed that the vulnerabilities are now being actively exploited. Patchstack observed attacks targeting WordPress sites, while Hexastrike detected exploitation attempts in its honeypots as early as the weekend. According to the company, it has since provided incident response support to various organizations. Hexastrike also published guidelines for identifying and investigating compromises.
WatchTower also confirms that the vulnerabilities are now being exploited in the wild.
According to founder and CEO Benjamin Harris, the incident demonstrates just how narrow the window between disclosure and exploitation has become. Whereas proof-of-concept code used to often become available only a day later, it now appears within a matter of hours. According to Harris, this is partly due to AI-powered tools that help both security researchers and attackers analyze and automate vulnerabilities more quickly.
Self-hosted installations are particularly at risk
Not all WordPress users face the same risk, however. Automattic, the company behind WordPress.com, told TechCrunch that websites hosted via WordPress.com, Pressable, WPVIP, and WP.cloud were already protected before the patches were made public. The greatest risks, therefore, lie with self-hosted WordPress installations that are not automatically updated or that require manual installation of security updates.
According to TechCrunch, automatic updates, web application firewalls, and additional protections from providers such as Cloudflare limit the number of successful attacks, but unpatched systems remain attractive targets for attackers.
Prompt patching is crucial
The incident underscores once again the importance of immediately applying security updates to WordPress installations. Although many hosting providers support automatic updates, not all websites do. It is precisely systems that are managed manually or have updates disabled that are at the greatest risk of falling victim to this new attack chain.
For organizations that use WordPress for business purposes, it is also advisable to review log files for suspicious activity and verify that systems are up to date to version 6.9.5 or 7.0.2.