WordPress Sites Under Siege: Critical wp2shell Flaws Deploy Persistent Backdoors

Robert Moore · 2026-07-21

If you run a WordPress site, you need to hear about this. Hackers are actively exploiting a pair of critical vulnerabilities in the wp2shell plugin, tracked as CVE-2026-63030 and CVE-2026-60137. These aren't your average bugs. They let attackers plant permanent webshells on your server and install malicious plugins without you knowing. It's like handing someone a key to your house, and they decide to move in. This isn't a drill. The attacks are happening right now, targeting WordPress Core installations that have the wp2shell plugin active. Once a hacker gets in, they can do almost anything: steal data, deface your site, or use your server to attack others. The scariest part? These webshells are designed to be persistent. Even if you patch the vulnerability, the backdoor might still be there. ### What Are These Vulnerabilities? Let's break down the two flaws. CVE-2026-63030 is a remote code execution (RCE) vulnerability. It allows an unauthenticated attacker to run arbitrary commands on your server. Think of it as a backdoor that's already open. CVE-2026-60137 is a privilege escalation bug. It lets an attacker with limited access gain full admin rights. Together, they're a nightmare. Here's the kicker: both vulnerabilities were discovered in the wp2shell plugin, which is used by many site owners for legitimate server management. But the plugin's code had a flaw that made it easy to exploit. The developer released a patch, but not everyone has updated. That's where the trouble starts. ### How the Attack Works The attack chain is straightforward but devastating. First, a hacker scans the web for sites running the vulnerable wp2shell plugin. Once they find one, they send a specially crafted request to exploit CVE-2026-63030. This gives them a foothold on the server. Then they use CVE-2026-60137 to escalate their privileges to administrator level. From there, they install a webshell. A webshell is a small script that gives them ongoing access to your server. It's like a secret entrance that they control. They can then upload malicious plugins, steal your database, or even use your server for phishing campaigns. The whole process takes minutes. ### How to Protect Your Site You don't need to be a security expert to defend against this. Here's what you should do right now: - Update the wp2shell plugin immediately. Check your WordPress admin dashboard for the latest version. If you're not sure, ask your hosting provider. - Scan your site for webshells. Use a security plugin like Wordfence or Sucuri. These tools can find hidden scripts. - Change all admin passwords. Even if you think you're safe, do it. Use strong, unique passwords. - Enable two-factor authentication. This adds an extra layer of security. - Review your installed plugins. Remove any you don't recognize or don't need. ### What to Do If You're Already Compromised If you suspect your site has been hit, don't panic. Here's a step-by-step plan: 1. Take your site offline temporarily. This stops the attacker from doing more damage. 2. Contact your hosting provider. They can help you identify and remove the webshell. 3. Restore from a clean backup. Make sure the backup is from before the attack. 4. Change all credentials, including FTP, database, and admin logins. 5. Install a web application firewall (WAF). This blocks malicious traffic. Remember, even after cleaning up, stay vigilant. Attackers often leave multiple backdoors. A thorough scan is essential. ### The Bigger Picture This isn't just about one plugin. It's a reminder that WordPress security is an ongoing process. Plugins are a major attack vector because they add complexity. Every plugin you install is a potential door for hackers. Keep them updated, remove what you don't use, and always have a backup plan. The wp2shell vulnerabilities are a serious threat, but they're also a wake-up call. If you take action now, you can protect your site and your visitors. Don't wait until it's too late.