The WP2Shell vulnerabilities consist of two flaws: CVE-2026-60137, a high-severity SQL injection vulnerability, and CVE-2026-63030, a critical arbitrary code execution vulnerability. When chained, these allow unauthenticated remote code execution on affected WordPress sites. The affected versions are WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Exploitation requires no plugins or special conditions. WordPress released patches in versions 6.9.5 and 7.0.2 and enforced auto-updates for these versions. Multiple cybersecurity firms have confirmed active exploitation attempts and have provided detection and response guidance. Cloudflare has deployed rules to detect and block exploitation attempts for unpatched sites.

Successful exploitation enables unauthenticated attackers to execute arbitrary code remotely on vulnerable WordPress installations, potentially allowing full site takeover. This poses a significant risk to the confidentiality, integrity, and availability of affected websites. Given WordPress's widespread use, the vulnerabilities have a broad impact surface. Exploitation has been confirmed in the wild shortly after disclosure, increasing the urgency for patching.

WordPress has released official patches in versions 6.9.5 and 7.0.2 and has enabled forced auto-updates for affected versions to mitigate exploitation. Site administrators should verify that their WordPress installations are updated to these versions or later. Cloudflare and other security providers have implemented detection and blocking rules to protect unpatched sites. Immediate patching is the primary recommended mitigation. No additional vendor advisories indicate alternative mitigations or that no action is required.