WP2Shell Wordpress Core Critical Remote Code Execution Vulnerabilities, CVE-2026-60137 and CVE-2026-63030
Subscribe
Investigating - On July 17th Wordpress.org announced two critical remote code execution (RCE) vulnerabilities commonly known as WP2Shell. These vulnerabilities exist in Wordpress Core and allow an unauthenticated request to execute arbitrary code on the target website.
Customers running the Wordpress versions below are strongly advised to upgrade to latest version shown as soon as possible:
Wordpress 6.8.x; fixed in 6.8.6
WordPress 6.9.x; fixed in 6.9.5
WordPress 7.0.x; fixed in 7.0.2
WordPress 7.1 beta, fixed in 7.1 beta2
Source: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
Jul 17, 2026 - 20:46 CDT
Customers running the Wordpress versions below are strongly advised to upgrade to latest version shown as soon as possible:
Wordpress 6.8.x; fixed in 6.8.6
WordPress 6.9.x; fixed in 6.9.5
WordPress 7.0.x; fixed in 7.0.2
WordPress 7.1 beta, fixed in 7.1 beta2
Source: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
Jul 17, 2026 - 20:46 CDT
PHP Services
Operational
LAN
Operational
PHX
Operational
IIS Services
Operational
LAN
Operational
PHX
Operational
MariaDB
Operational
LAN
Operational
PHX
Operational
MSSQL
Operational
LAN
Operational
PHX
Operational
FTP
Operational
LAN
Operational
PHX
Operational
Management Portal
Operational
Management Portal
Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance