---
id: 6792
title: "Exploitation in the Wild of wp2shell"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137"
published_at: "2026-07-20T18:00:08Z"
tags: ["rce", "wordpress", "vulnerability", "webshell", "cve-2026-63030", "cve-2026-60137", "exploit-in-the-wild"]
phying_url: "https://phying.com/item/6792"
lang: en
---

# Exploitation in the Wild of wp2shell

## Summary

Wiz Research observed in-the-wild exploitation of wp2shell, a pre-auth RCE chain in WordPress Core (CVE-2026-63030, CVE-2026-60137), used to install persistent webshells and backdoor plugins.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2026-07-20T18:00:08Z
- **Original:** https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137
- **Phying News:** https://phying.com/item/6792