A critical attack chain known as WP2Shell is being actively exploited against vulnerable WordPress Core installations. The attack chains CVE-2026-63030 and CVE-2026-60137 to achieve unauthenticated remote code execution, allowing attackers to compromise WordPress sites without requiring plugins or user interaction.
#FortiGuardLabs continues to observe exploitation attempts in the wild, with the highest attack activity targeting Poland, Australia, Japan, the United States, and Turkey. Organizations should immediately update WordPress to a patched version and ensure FortiGuard IPS protections are enabled.
Visit FortiGuard Labs for the latest Outbreak Alerts, threat intelligence, and mitigation guidance. https://www.fortiguard.com/outbreak-alert/wp2shell-rce
Subscribe to our Outbreak Alerts: https://www.fortinet.com/fortiguard/outbreak-alert-subscription
Read our blog: https://www.fortinet.com/blog
Follow us on LinkedIn: https://www.linkedin.com/company/fortinet/
