WordPress Unauthenticated Code Execution Vulnerabilities
The story began on 17 July, when The Hacker News reported wp2shell, a WordPress Core flaw said to let unauthenticated attackers run code. BleepingComputer later reported that attackers were exploiting critical wp2shell flaws to install webshells. Public exploits became available, and The Hacker News described growing mass scanning. On 20 July, the SANS Internet Storm Center reported active exploitation of CVE-2026-63030. According to The Hacker News, WordPress issued a patch for a critical flaw that could enable code execution on some servers. BleepingComputer urged users to patch as public exploits circulated.
Separate reporting from The Hacker News described a pre-authentication XSS flaw that could lead to PHP code execution and a Forminator flaw that could allow unauthenticated remote code execution through malicious PHP uploads. On 18 September, The Hacker News reported Click2Shell, another WordPress flaw that could force theme installations and chain into code execution. BleepingComputer said attackers could use it to execute PHP on the server. Patches exist, exploit methods are public, and scanning has already moved beyond theory.
Taking the reports as factual, impact is 0%. WordPress site operators running affected Core or Forminator versions, or server configurations exposed to the reported execution paths, face the practical work of patching and checking for webshells, malicious PHP uploads, forced theme installations, and other signs of exploitation. The 0% score indicates no measured wider impact in this tracking assessment, despite the direct risk described in the reports.
Watch for WordPress advisories that identify affected versions and server configurations, along with further evidence of exploitation beyond mass scanning. Updated patches or new reports connecting Click2Shell, wp2shell, CVE-2026-63030, and the pre-authentication XSS findings would materially clarify the picture.
Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install
Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the
Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise
WordPress has fixed a critical flaw in its core software that lets an attacker with no account make a site load a PHP file from outside its theme folders. On some servers, that
Public exploits have been released for the critical "wp2shell" remote code execution vulnerabilities affecting WordPress Core, making it imperative that administrators patch their
Last week, Searchlight Cyber released details about a vulnerability they are calling "wp2shell". The vulnerability was initially announced without a CVE number. But now has been
WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. pwn.ai
A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability
NewsHive monitors these sources continuously. All signal titles above link to the original reporting.
Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →