Update WordPress Now to Fix Actively Exploited wp2shell Vulnerabilities
NEOSEC enrichment — no mirror of the original source
WordPress is urging users to update to WordPress 7.0.2 as soon as possible to address two actively exploited vulnerabilities affecting WordPress Core. Together they are known as wp2shell, and they can be chained to achieve unauthenticated r
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Editorial context in the original issue
The SANS NewsBites issue carries commentary by: Dukes, Frost, Neely, Ullrich.
Linked advisories
- CVE-2026-63030WordPress: SQL-Injection
- CVE-2026-63030WordPress: Mehrere Schwachstellen ermöglichen Codeausführung
- CVE-2026-60137WordPress Core — WordPress Core SQL Injection Vulnerability
- CVE-2026-60137WordPress: SQL-Injection
- CVE-2026-63030WordPress Core — WordPress Core Interpretation Conflict Vulnerability
Affected vendors and products
More on WordPress
Other advisories
- MediumCVE-2026-115955bPlugins Advanced Post Block - Post Grid for WordPress block editor: Cross-Site-Scripting (XSS)
- MediumCVE-2026-115955bPlugins Advanced Post Block - Post Grid for WordPress block editor: Cross-Site-Scripting (XSS)
- HighCVE-2026-55826Stape-io Gtm-server-side-wordpress-plugin: Offenlegung vertraulicher Informationen
- HighCVE-2026-55826Stape-io Gtm-server-side-wordpress-plugin: Offenlegung vertraulicher Informationen
- Not ratedosv:CVE-2026-55826Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin
- MediumCVE-2026-114696miniOrange Page Restriction WordPress (WP): fehlende Autorisierung
- MediumCVE-2026-114696miniOrange Page Restriction WordPress (WP): fehlende Autorisierung
- LowCVE-2026-88849MasterStudy LMS WordPress Plugin: fehlerhafte Autorisierung
Other news entries
- WordPress sites compromised after TeamUpdraft credential exposureNewsCSO Online
- Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress SitesNewsThe Hacker News
- Stolen UpdraftCentral keys used to backdoor WordPress sitesNewsBleepingComputer
- WordPress SEO plugin Rank Math compromised to backdoor websitesNewsBleepingComputer
- Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring BackdoorNewsThe Hacker News
- Rank Math PRO WordPress Plugin Compromised in Supply Chain AttackNewsSecurityWeek
- Bricksforge WordPress Plugin Vulnerability Exploited in the WildNewsSecurityWeek
- Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCENewsThe Hacker News
ID