Public WordPress wp2shell Exploit Triggers Global RCE Wave

Attackers are abusing two flaws, CVE-2026-63030 and CVE-2026-60137 (wp2shell), to achieve unauthenticated remote code execution on stock WordPress installs. Public PoCs and AI-assisted tooling have spurred widespread scanning and exploitation, including admin account creation, malicious plugins, and web shells like CMSmap. While automatic updates and some WAF protections have reduced risk, many sites may remain unpatched; defenders should patch immediately and audit for indicators of compromise such as new admins and suspicious plugins.