Vulnerability pair exploited: CVE-2026-63030, CVE-2026-60137 (Source: BleepingComputer, "Critical wp2shell WordPress flaws exploited to install webshells" (July 2026))
A Plugin Installer Becomes an Entry Point
Two vulnerabilities disclosed under the name 'wp2shell' — CVE-2026-63030 and CVE-2026-60137 — are being used against WordPress Core to deploy webshells and install malicious plugins on affected servers, according to BleepingComputer. The exploit chain does not target a third-party plugin; it reaches into WordPress's own plugin installation pathway, the mechanism every WordPress site depends on to add functionality. Once a webshell is placed, attackers hold command execution that can persist independently of the plugin that introduced it.
Why the Plugin Layer Keeps Reappearing in These Reports
WordPress's extensibility model is also its largest attack surface: core, themes, and tens of thousands of plugins each carry independent code paths, and each has shipped vulnerabilities over the platform's two-decade history. WebPulse's data collection from NVD/NIST records 18,005 cumulative CVEs across the WordPress ecosystem to date — a figure that reflects the scale of a plugin-driven architecture accumulating disclosures over 20+ years, not a single moment of failure. The wp2shell chain fits a pattern this dataset already shows: installer and update pathways are a recurring target because compromising them yields persistence, not just one-time access.
The Installed Base Still Carrying This Exposure
WordPress remains one of the most frequently detected content platforms in WebPulse's own scanning. In WebPulse's Tranco Top 10K census, WordPress accounted for 22.4% of detected frameworks — meaning a webshell technique that works against WordPress Core has a wide population of live installations to reach, independent of any single site's patch status. For budget owners, the relevant number is not the vulnerability count in isolation, but how much of the detected estate runs the affected core software and how quickly that estate applies updates once a fix ships.
What This Signals for Machine-Readable Infrastructure
WebPulse's broader thesis is that web infrastructure is increasingly read and acted on by automated systems — crawlers, AI agents, and now attack tooling that chains disclosed CVEs into working exploits within days of publication. A webshell installed through a core installer flaw does not announce itself to a human visitor; it is built to be found only by whoever installed it, or by tooling that checks for it. That asymmetry — attackers automating discovery and exploitation faster than defenders automate detection — is the same dynamic driving WebPulse's detection work across the roughly 30 frameworks it tracks. Sites carrying legacy plugin architectures represent a larger population to check, and a longer tail of unpatched instances, than platforms with narrower or more centrally managed update paths. Organizations running WordPress Core are advised to confirm whether their installation has received the patches addressing CVE-2026-63030 and CVE-2026-60137, and to review installed plugin lists for entries that were not deliberately added.
