Two decades
inside the web
as it kept rewriting
itself.

WP2Shell Exploitation Crisis

A critical vulnerability chain dubbed WP2Shell (CVE-2026-63030 and CVE-2026-60137) is under massive active exploitation by threat actors [2][8]. The chain involves a REST API batch-route confusion and SQL injection within WordPress Core, allowing attackers to deploy persistent web shells for remote code execution (RCE) [4][8]. CISA has issued warnings regarding the interpretation conflict leading to these exploits [4].

Critical Plugin Security Alerts

Multiple high-impact vulnerabilities have been identified in widely-used tools:

• UpdraftPlus: A critical unauthenticated authentication bypass vulnerability has been patched; immediate updates are required for backup security [1].
• Avada Builder: A critical unauthenticated arbitrary file deletion flaw was discovered, posing a significant risk to sites using this popular page builder [1].
• High Volume: 109 new security vulnerabilities were disclosed across the WordPress ecosystem between July 18 and July 25, 2026 alone [3].

Emerging Attack Patterns

Threat researchers report that hackers are now exploiting vulnerabilities immediately following their public disclosure [2][5]. Millions of websites remain at risk due to the gap between patch release and administrator implementation [5][7]. Current campaigns specifically target recently disclosed flaws to gain unauthorized access before remediation can occur [5].

Infrastructure & Hosting Impact

Infrastructure teams should note the critical nature of CVE-2026-63030, which affects the WordPress REST API, a common vector for automated attacks [7][9]. The WP2Shell chain is highly effective because it targets core functions rather than fringe plugins, requiring broad-scale patching across all hosted instances [8][9].