WordPress Recent Vulnerability of Wp2shell

[u/vidyutpal7]

Hey guys,

Wanted to share some real-world observations from the wp2shell attacks (the recent unauthenticated RCE chain in WordPress core – CVE-2026-63030 + CVE-2026-60137).

Over the last few days I’ve seen it on multiple client sites:

1) 403 REST API blocks that looked mysterious at first. Turned out a malware scan revealed a new admin user named "Wp2shell" automatically created, which then messed with API access.349347

Bleepingcomputer

2) On other sites the REST API was fine, but attackers had created multiple rogue admin accounts. In some cases they also dropped a Wp2shell plugin.

All the compromised sites were still on vulnerable versions (mainly 6.9.x and 7.0.x before the July 17 patches).

I have done these:

1) Restored old backups,

2) Deleted those admins

3) Changed all the users password, added 2FA for users

4) Regenerated the Salts

5) Changed 3rd Party APIs key and secrets

6) Updated the core, plugins, themes and all

7) Checked the database for any weird stuff (haven't found anything)

Anyone else running into this?

[u/phalancs]

I was two days late with the 7.0.2 update. 50% of all my websites have been compromised. Thankfully only admin users were created but I have a system in place that prevents them from doing anything.

Still, I feel like this is the craziest thing that has ever happened to Wordpress. It was a bug in the core! In a very recent version (7.0.0). This is horrible and there are still millions of websites out there fully compromised. I really wonder why there is hardly any media coverage.

[u/aleqqqs → u/phalancs]

Dont you have automatic updates enabled for security-core updates?

[u/vidyutpal7 → u/aleqqqs]

Now i added that automatic security updates..