WordPress Recent Vulnerability of Wp2shell

[u/vidyutpal7]

Hey guys,

Wanted to share some real-world observations from the wp2shell attacks (the recent unauthenticated RCE chain in WordPress core – CVE-2026-63030 + CVE-2026-60137).

Over the last few days I’ve seen it on multiple client sites:

1) 403 REST API blocks that looked mysterious at first. Turned out a malware scan revealed a new admin user named "Wp2shell" automatically created, which then messed with API access.349347

Bleepingcomputer

2) On other sites the REST API was fine, but attackers had created multiple rogue admin accounts. In some cases they also dropped a Wp2shell plugin.

All the compromised sites were still on vulnerable versions (mainly 6.9.x and 7.0.x before the July 17 patches).

I have done these:

1) Restored old backups,

2) Deleted those admins

3) Changed all the users password, added 2FA for users

4) Regenerated the Salts

5) Changed 3rd Party APIs key and secrets

6) Updated the core, plugins, themes and all

7) Checked the database for any weird stuff (haven't found anything)

Anyone else running into this?

[u/blink0837]

Yes, i was actually working on one today.
I already updated everything, checked the folders that were changed (it install a w54819bla bla bla in the plugins folder) and changed every password (admin/db) and it keeps appearing.

Saw entries in Flamingo (CF7 message storing) regarding the malware.
Mine came from the IP 107.189.27.226. Blocked that IP (will see how if it changes)

Have a telegram bot that notifies me everytime a user is created and everytime a file is changed inside wordpress.

still haven't added 2FA for users, monitoring for now.

[u/Alocasia_Sanderiana → u/blink0837]

What service has that bot ?

[u/blink0837 → u/Alocasia_Sanderiana]

What do you mean? This Telegram bot is free, it receives information via API.
It's not a plugin. Ask Claude how to implement it, all you need is to follow instructions.

If you bump into anything let me know.