A devastating cybersecurity threat has emerged in the form of “WP2Shell”, an exploit chain that allows attackers to take control of millions of WordPress sites worldwide. Barely three days after the vulnerabilities were disclosed, malicious actors are already chaining together two critical flaws – CVE-2026-60137 and CVE-2026-63030 – to launch large-scale attacks against some of the internet’s most vulnerable targets.
The two bugs, identified by researchers at Searchlight Cyber using advanced AI tools, enable unauthenticated remote code execution (RCE) on default WordPress installs. This means that an attacker with no login credentials can gain full control over a site’s database and execute malicious code. The situation is particularly dire because the flaws are easy to exploit, thanks in part to the availability of proof-of-concept exploits.
The affected sites number in the hundreds of millions – potentially even more – and include those running WordPress versions 6.9.0-6.9.4 and 7.0.0-7.0.1. The WordPress team responded quickly by releasing a security update on July 17 that addresses both vulnerabilities, but experts warn that the window for exploitation is likely already closed for many organizations.
“We’ve seen a high likelihood of compromise in sites that haven’t patched yet,” says Jake Knott, principal security researcher at watchTowr. “Defenders need to inspect their WordPress instances for new administrator accounts, malicious plug-ins, or other suspicious files, regardless of whether they’ve patched.”
The exploitation is being fueled by the ready availability of public exploit code and the speed with which attackers can use advanced AI tools like GPT-5.6 Sol Ultra to develop and execute exploits. “I make no general claims, but I can say with complete confidence that no security researcher could have found and completed this exploit chain in 10 hours without AI,” says Adam Kues, security researcher at Searchlight Cyber.
The situation highlights the potential for malicious power of AI tools in cybersecurity threats. As experts warn, the exploitation is likely to continue unless affected sites are patched urgently. “Affected users should update to a fixed version of WordPress as soon as possible, given the overwhelming likelihood that various public exploits and large-scale exploitation will follow the high-profile disclosure,” says VulnCheck.
In light of this threat, it’s essential for website owners to take immediate action. This includes updating WordPress to the latest version, inspecting site logs for suspicious activity, and monitoring for new administrator accounts or malicious plug-ins. While the situation is dire, prompt action can help mitigate the damage.
Source: Dark Reading — 2026-07-20