wp2shell: the year WordPress came under mass attack

In the summer of 2026, two vulnerabilities discovered in the WordPress core itself — CVE-2026-63030 and CVE-2026-60137, known together as “wp2shell” — allowed, when chained, code to be run on the server without any authentication. The exploit code became public, and mass attacks began almost immediately after publication: bots scan the internet non-stop for exactly this kind of opportunity.

Why WordPress is the favourite target

WordPress powers hundreds of millions of websites. This means a single flaw gives attackers millions of identical targets, with the same attack recipe. On top of the core itself comes the huge ecosystem of third-party plugins and themes — many abandoned by their authors or rarely updated — which constantly produces new vulnerabilities, year after year.

To say it plainly: WordPress is not a “bad” tool. It is simply the most widespread, and therefore the most attacked, and that calls for serious, permanent maintenance — core, themes and plugins updated as soon as fixes are released, not “when we have time”.

What this means for a company website

If the company website is built on WordPress, someone has to update it and watch over it continuously. A site installed two years ago and left alone since is not “stable” — it is an unlocked door. Episodes like wp2shell turn such sites into victims within a few hours.

Where AI Soft websites stand

Websites built by AI Soft România use our own code, without WordPress and without third-party plugins. The attack surface is much smaller: we do not depend on hundreds of external developers and their update schedules, and everything running on the server is written and maintained by us. Security updates for the servers and the code are included in hosting — they are not the client’s responsibility.

Whatever your website is built on, the question remains the same, and wp2shell and PHP2Shell made it more relevant than ever this year: who maintains it?