Currently, there is an increasing wave of attacks on WordPress websites worldwide. Cybercriminals exploit critical vulnerabilities to attack vulnerable systems and, in the worst case, take over completely.
It is particularly critical that the vulnerability is located directly in the WordPress core and not in a plugin or theme. This can affect numerous WordPress installations.
We are also currently observing an increasing number of security incidents in connection with compromised WordPress installations as part of our incident response missions. This underscores the importance of updating affected systems in a timely manner and checking for signs of compromise.
In the following, you will learn how the attack chain works, why it poses a high risk to companies and what measures are now recommended.
What happened?
The attack chain known as “WP2Shell” combines two vulnerabilities (CVE-2026-63030 and CVE-2026-60137). Together, they enable attackers to manipulate database queries (SQL injection – the injection of database commands) and then execute their own malicious code on the web server (remote code execution – the execution of commands remotely).
No valid credentials are required for the attack. Instead, the attackers use the vulnerabilities to bypass security mechanisms and take control of a vulnerable WordPress installation. After a successful compromise, web shells (programs that give attackers permanent remote access to the server) or other backdoors can be installed, websites can be manipulated, malware can be spread or confidential data can be stolen.
Why is this so critical?
The attack chain achieves one of the highest possible severity levels with a CVSS score of 9.8 out of 10 points . However, it is particularly critical that the vulnerability is already being actively exploited.
We are also currently observing an increasing number of security incidents in connection with compromised WordPress installations as part of our incident response missions . In several cases, attackers gained permanent access to the web server via installed web shells , stole sensitive data or used compromised systems to attack other websites within the same hosting environment.
Since WordPress is one of the world’s most widely used content management systems (CMS) and many websites are publicly accessible, attackers automatically search for vulnerable installations. Systems that are not updated can be compromised within a short period of time.
What is affected?
|
The following WordPress versions are not affected, as the vulnerability has already been fixed there. You should update your systems to these versions: |
|
How can I protect myself?
Companies and website operators should check promptly whether their WordPress installation is affected and take appropriate protective measures. In particular, we recommend the following steps:
Important: A security update prevents further attacks, but does not remove backdoors or malware that have already been installed. If there is a suspicion of a successful compromise, the incident should first be forensically investigated. Only then should a decision be made on whether to clean up or restore the system in order to secure possible evidence and assess the actual scope of the attack.
Conclusion
The current wave of attacks once again illustrates how quickly cybercriminals exploit critical vulnerabilities in widely used web applications. Especially with publicly accessible systems such as WordPress, there can be only a few hours or days between the publication of a security vulnerability and the first attacks.
Companies should therefore not only install the available security updates promptly, but also regularly check their systems for signs of compromise. This includes, in particular, the control of user accounts, installed extensions and web server logs.
If you want to take a closer look at attacks on content management systems and suitable protective measures, you can find more information in our white paper “CMS Systems under Attack“. In it, we show typical attack methods, common vulnerabilities and proven measures that can be used to effectively secure WordPress and other CMS solutions.
Do you want to stay informed about current threats and security vulnerabilities?
Subscribe to our newsletter and receive important warnings, recommendations for action and assessments of current cyber risks directly in your inbox.
Sources & Further Information