WordPress site owners face a short response window after exploit attempts were detected against two WP2Shell vulnerabilities. The flaws can be used by anonymous attackers against standard WordPress installations without requiring a login or a specific plugin.
WordPress has issued versions 6.9.5 and 7.0.2 to address the risk. Automatic updates were also enabled for sites running affected releases because of the severity of the vulnerabilities.
The affected version ranges are WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Sites still operating within those ranges should verify both their installed version and the update status provided by their hosting service.
Exploitation Activity Has Been Observed
Patchstack reported seeing exploitation attempts targeting the flaws. Hexastrike also detected attacks through its honeypot system over the weekend and helped handle several incidents connected to the exploitation activity.
WatchTowr identified related activity as well, according to reporting cited by Security Week. Its chief executive, Benjamin Harris, warned that the potential impact could be broad because WordPress is used by hundreds of millions of websites worldwide.
Technical details of the vulnerabilities have not been fully published by Searchlight Cyber in an effort to limit misuse. However, proof-of-concept exploit material was reported to have circulated from other parties.
Harris said the period between vulnerability disclosure and the availability of attacks is becoming shorter. “In the past, exploits usually appeared at least 24 hours after a vulnerability was announced. Now, with the help of AI, proof-of-concept exploits can appear in just hours,” he said.
Two Flaws Can Be Combined
The WP2Shell issue consists of two vulnerabilities with different functions. Used together, they could give an attacker a route from database query manipulation to remote code execution on a targeted server.
| Vulnerability | Type | Severity |
|---|---|---|
| CVE-2026-60137 | SQL Injection | High |
| CVE-2026-63030 | Remote Code Execution | Critical |
Searchlight Cyber classified CVE-2026-60137 as a high-severity SQL Injection vulnerability. CVE-2026-63030 was identified as a critical Remote Code Execution, or RCE, vulnerability.
When combined, the two issues could allow malicious code to run on a server before authentication takes place. Such access could ultimately result in full control of the targeted WordPress site.
Searchlight Cyber said the attack has no special prerequisites. “The attack has no prerequisites and can be exploited by anonymous users on a standard WordPress installation without plugins,” the cybersecurity company said.
Protection Requires More Than Detection Rules
Cloudflare has added new security rules intended to help identify exploitation attempts on customer sites that have not yet been updated. The additional protection may help reduce exposure, but it is not a replacement for installing the patched WordPress release.
Some sites may receive the fix automatically through their hosting providers. Harris noted that many others may not receive automatic updates, leaving them exposed if they remain on vulnerable versions.
Updating to WordPress 6.9.5 or 7.0.2 is therefore a central step for affected installations. Site owners should also confirm that automatic update processes are active so security fixes are not delayed.
