'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover

Two critical vulnerabilities in WordPress, CVE-2026-60137 and CVE-2026-63030, are being actively exploited to enable unauthenticated remote code execution (RCE) on millions of sites. When combined, these flaws allow attackers to fully compromise default installations without needing login credentials. The vulnerabilities were discovered using AI tools and have already led to widespread exploitation, including the creation of backdoor admin accounts and deployment of malware like Overlord RAT. WordPress has issued a patch in version 7.0.2, urging all users to update immediately.