'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover

Researchers disclosed the "WP2Shell" chain that attackers are actively using to achieve remote takeover of millions of Internet-facing WordPress sites by chaining CVE-2026-60137 and CVE-2026-63030. Exploitation began within days of disclosure and is widespread across a large attack surface; organizations should assume active scanning and compromise attempts. Immediate actions: apply vendor patches/updates, deploy WAF/virtual patching rules to block exploit payloads, scan for web shells/backdoors and indicators of compromise, rotate exposed credentials and secrets, and monitor/contain affected/