Wiz Confirms Real-World wp2shell Exploits, Threatening 40% of WordPress Sites
Wiz’s research shows attackers are actively weaponising the wp2shell pre‑auth RCE chain (CVE‑2026‑63030, CVE‑2026‑60137) to drop persistent webshells on vulnerable WordPress installations – a flaw present in roughly 40% of live sites. The observed post‑exploitation steps include malicious plugin uploads, admin enumeration and local file inclusion, prompting immediate patching or WAF protection.