> TritonInfoSec News
Home / Jul 22, 2026 / Story
0
#2 BleepingComputer general July 21, 2026 at 16:41 UTC

Critical wp2shell WordPress flaws exploited to install webshells

By Bill Toulas

AI Summary

Two critical WordPress Core vulnerabilities — CVE-2026-63030 and CVE-2026-60137, dubbed 'wp2shell' — are being chained by attackers to achieve unauthenticated RCE, deploy persistent webshells, and install malicious plugins. Mass scanning began within hours of a public exploit being released, and exploitation was confirmed by early Saturday morning UTC, making immediate patching urgent for the roughly 40% of websites running WordPress.

Read full article → https://www.bleepingcomputer.com/news/security/cri…

Relevance score: 90.0/100

# More from July 22

  1. 1
    Critical SharePoint RCE flaw exploited to steal machine keys BleepingComputer
  2. 3
    Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access The Hacker News
  3. 4
    SonicWall SMA1000 flaws exploited as zero-days to push custom malware BleepingComputer
  4. 5
    Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution The Hacker News
  5. 6
    FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware BleepingComputer
  6. 7
    Police dismantle Kratos phishing platform, arrest developer BleepingComputer
  7. 8
    New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack The Hacker News
  8. 9
    Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes BleepingComputer
  9. 10
    HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050 The Hacker News