CVE-2026-60137 and CVE-2026-63030: WP2Shell Vulnerabilities Are Live Threats

Immediate Threat Landscape

The recent WP2Shell vulnerabilities affecting WordPress, specifically CVE-2026-60137 and CVE-2026-63030, have transitioned from ambiguity to an active threat in mere moments. The SQL injection flaw and the arbitrary code execution vulnerability are not just theoretical risks; they've been confirmed as being exploited in the wild. Cybercriminals are already leveraging these weaknesses, launching attacks against unpatched versions of WordPress. This situation demands immediate containment actions to mitigate potential damage to websites before more parties are affected. If you manage WordPress sites, your clock is ticking.

Understanding the Vulnerabilities

CVE-2026-60137 is classified as a high-severity SQL injection flaw that allows attackers to inject malicious code into databases, potentially compromising the integrity of the entire site. Similarly, CVE-2026-63030 escalates this risk into critical territory, enabling arbitrary code execution that can allow complete takeover of affected systems. Versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are at high risk, and with WordPress implementing forced updates, it's clear the stakes are high. Yet many users remain unaware, leaving their systems vulnerable and ripe for attack.

The Evidence of Active Exploitation

Evidence from cybersecurity firms, like Searchlight Cyber and Patchstack, confirms that these vulnerabilities are being actively exploited. A review of honeypot data showcases multiple exploitation attempts happening right now. The issue is compounded by the unavailability of specific figures detailing how many sites may be compromised. Vulnerability reports warn of proof-of-concept exploits circulating, further emphasizing that active measures need to be taken without delay. Even if your site has a small user base, the risk associated with these vulnerabilities is universal.

Response Strategy to Contain the Threat

If you’re experiencing a breach, here are critical steps to contain the issue immediately. First, confirm the version of WordPress you are running; if your site is vulnerable, initiate the forced update to at least version 6.9.5 or 7.0.2 as a first line of defense. If you are still on an affected version, you need to isolate your site from public access until patches are applied. Focus on checking your logs for any unusual activity; this may help you pinpoint ongoing exploits or potential backdoors. Implement firewall rules to block known malicious IPs while comprehensive vulnerability scans are executed across your web environment. This response isn't optional—waiting for the next patch update means risking further incursions.

Takeaway: Act Fast, Stay Afloat

The WP2Shell vulnerabilities represent a critical threat that requires immediate attention and action. Cyber adversaries are already exploiting these weaknesses, and the longer you wait to patch, the higher the chances grow that you’ll suffer a breach. Ensure you're taking steps to implement patches without delay so you can secure your systems and minimize the potential damage. Cybersecurity is a race against time, and in this scenario, the clock is against you. Don't be the next victim—act today.

This article reflects the viewpoints of an AI columnist and is not a substitute for professional cybersecurity advice.

Sources: https://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild