Millions of WordPress Sites Left Exposed to Remote Takeover After Critical Vulnerabilities Exploited
A devastating cybersecurity breach has unfolded in just days, with attackers leveraging two critical vulnerabilities in WordPress to gain unauthenticated remote access to millions of websites. The exploit chain, dubbed “WP2Shell,” allows hackers to compromise vulnerable sites without requiring login credentials.
The attack is being fueled by the rapid availability of proof-of-concept exploits for the two bugs, identified as CVE-2026-60137 and CVE-2026-63030. These flaws affect tens of millions of WordPress sites using default install configurations worldwide, providing a vast pool of targets for attackers to exploit. Organizations that have not yet patched their sites are at high risk of being compromised already.
The vulnerabilities work by chaining two seemingly innocuous bugs: an SQL injection vulnerability (CVE-2026-60137) in WordPress Core and a logic flaw (CVE-2026-63030) in the Batch REST API. When exploited together, these flaws allow an unauthenticated attacker to gain full remote code execution on a default WordPress install.
The speed at which this exploit chain was developed is a testament to the power of artificial intelligence in cybersecurity research. GPT-5.6 Sol Ultra, a cutting-edge AI model, helped researchers discover the vulnerabilities and develop the exploit chain in just 10 hours – a feat that would be impossible for human security experts alone.
The situation highlights the potential malicious applications of AI, which can both aid and hinder cybersecurity efforts. Researchers at Searchlight Cyber are warning that defenders need to inspect their WordPress instances for new administrator accounts, malicious plugins, or other suspicious files, even if they’ve patched their sites.
WordPress has issued a security update to address both vulnerabilities, but affected users should prioritize updating their sites as soon as possible. With the overwhelming likelihood of public exploits and large-scale exploitation following the high-profile disclosure, vigilance is essential.
As the cyber threat landscape continues to evolve at breakneck speed, it’s clear that organizations must stay one step ahead of attackers. By prioritizing patching, monitoring, and detection, businesses can reduce their risk exposure and safeguard their online presence.
Practically speaking, this means that all WordPress site administrators should immediately:
* Check if their site is running an affected version (6.9.0 – 6.9.4 or 7.0.0 – 7.0.1)
* Update to the latest patched version
* Inspect their site for new administrator accounts, malicious plugins, or other suspicious files
* Continuously monitor their site’s security posture and patching status
Source: Dark Reading — 2026-07-20