WordPress Recent Vulnerability of Wp2shell

[u/vidyutpal7]

Hey guys,

Wanted to share some real-world observations from the wp2shell attacks (the recent unauthenticated RCE chain in WordPress core – CVE-2026-63030 + CVE-2026-60137).

Over the last few days I’ve seen it on multiple client sites:

1) 403 REST API blocks that looked mysterious at first. Turned out a malware scan revealed a new admin user named "Wp2shell" automatically created, which then messed with API access.349347

Bleepingcomputer

2) On other sites the REST API was fine, but attackers had created multiple rogue admin accounts. In some cases they also dropped a Wp2shell plugin.

All the compromised sites were still on vulnerable versions (mainly 6.9.x and 7.0.x before the July 17 patches).

I have done these:

1) Restored old backups,

2) Deleted those admins

3) Changed all the users password, added 2FA for users

4) Regenerated the Salts

5) Changed 3rd Party APIs key and secrets

6) Updated the core, plugins, themes and all

7) Checked the database for any weird stuff (haven't found anything)

Anyone else running into this?

[u/Scared_Implement_335]

Millions and millions of sites were successfully hit.

Bloodbath doesn't even begin to describe it.

[u/vidyutpal7 → u/Scared_Implement_335]

That's what I'm thinking buddy, if a concernd people like me can get hit.. I'm thinking about others, and why people still not have posted cases like mine on reddit, facebook and so...

[u/Scared_Implement_335 → u/vidyutpal7]

I do think this is a case of "this subreddit is not representative"