WordPress Under Attack: The Critical Vulnerability IT Doesn’t Know It Has

In this episode of IT SPARC Cast – CVE of the Week, John and Lou discuss WP2Shell, a critical WordPress remote code execution vulnerability chain (CVE-2026-63030 and CVE-2026-60137) that allows attackers to compromise default WordPress installations without authentication or plugins. Even though emergency patches were released quickly, thousands of vulnerable sites remain online—and many organizations may not even realize they’re running WordPress.

The discussion also explores the growing security risks posed by Shadow IT, why automatic updates are essential, and how services like Cloudflare helped protect customers before many administrators even knew the attack existed. If your organization hosts websites or internal applications, this episode is a reminder that visibility and rapid patching are now critical security requirements.

⸻

📄 Show Notes

🚨 CVE of the Week

WP2Shell: Critical WordPress Remote Code Execution

This week’s security spotlight focuses on WP2Shell, a vulnerability chain combining CVE-2026-63030 and CVE-2026-60137 that enables unauthenticated remote code execution against default WordPress installations.

Researchers initially withheld technical details, but attackers quickly reverse-engineered the patches. Within days:

Public proof-of-concept exploits appearedMultiple exploit variants were releasedSecurity firms confirmed widespread internet-wide exploitationThousands of vulnerable WordPress sites remained online

Because WordPress is frequently deployed outside formal IT processes, many organizations may have vulnerable systems they don’t even know exist.

Recommended Actions

Verify WordPress automatic updates are enabledConfirm all WordPress instances are fully patchedScan your environment for unauthorized or forgotten WordPress deploymentsReview externally hosted websites and Shadow IT projectsConsider web application protection services such as Cloudflare for additional defense