CVE-2026-60137

LLM-synthesized narrative grounded in this CVE's description and references.

• WordPress/WordPress2 versions

  cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*+ 1 more

  • cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*range: >=6.8,<6.8.6
  • (no CPE)range: <6.8.6, <6.9.5, <7.0.2

  Package: https://wordpress.org/plugins/wordpress
• osv-coords2 versions

  pkg:bitnami/wordpresspkg:bitnami/wordpress-multisite

  >= 6.8.0, < 6.8.6+ 1 more

  • (no CPE)range: >= 6.8.0, < 6.8.6
  • (no CPE)range: >= 6.8.0, < 6.8.6

• github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjfnvdVendor Advisory
• wordpress.org/news/2026/07/wordpress-7-0-2-release/nvdRelease Notes
• www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

• Metasploit Wrap Up: Payloads and Exploits, and Scanners, Oh my!
  Rapid7 Blog · Aug 28, 2026
• Metasploit Wrap Up: Lot of summer shells and fit http profiles
  Rapid7 Blog · Aug 14, 2026
• WordPress 7.0.3 Released: 12 Vulnerabilities Found and Fixed
  Patchstack Blog · Aug 6, 2026
• WP2Shell WordPress Exploit Technical Analysis and Real Attack Data
  Wordfence Blog · Jul 29, 2026
• Wordfence Intelligence Weekly WordPress Vulnerability Report (July 13, 2026 to July 19, 2026)
  Wordfence Blog · Jul 23, 2026
• Don’t swing at everything
  Cisco Talos Intelligence · Jul 23, 2026
• Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
  The Hacker News · Jul 22, 2026
• CISA Warns of WordPress Core SQL Injection Vulnerability Actively Exploited in the Wild
  Cyber Security News · Jul 22, 2026
• Ninety minutes: watching attackers weaponize the WordPress core RCE
  Patchstack Blog · Jul 22, 2026
• Critical wp2shell WordPress flaws exploited to install webshells
  BleepingComputer · Jul 21, 2026
• WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning
  The Hacker News · Jul 21, 2026
• WordPress: 2 Actively-Exploited Flaws Added to CISA KEV
  Vypr Intelligence · Jul 21, 2026
• Attackers pummel critical WordPress vuln to create all sorts of mischief
  The Register Security · Jul 20, 2026
• wp2shell Aftermath: The First Critical Unauthenticated WordPress Core RCE in Nearly a Decade
  Wordfence Blog · Jul 20, 2026
• 'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover
  Dark Reading · Jul 20, 2026
• Critical wp2shell RCE Vulnerability – Complete Coverage Including PoC and Active Exploitation Details
  Cyber Security News · Jul 20, 2026
• Researchers Build WordPress Exploit Using OpenAI's GPT
  Infosecurity Magazine · Jul 20, 2026
• wp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Core
  Tenable Blog · Jul 20, 2026
• ⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
  The Hacker News · Jul 20, 2026
• 20th July – Threat Intelligence Report
  Check Point Research · Jul 20, 2026
• WP2Shell WordPress Vulnerabilities Exploited in the Wild
  SecurityWeek · Jul 20, 2026
• Weekly Cyber Security Newsletter Bulletin – EY Breach, Wpzshell Exploit, Notepad++ Flaws +20 Stories
  Cyber Security News · Jul 19, 2026
• WordPress Core "wp2shell" RCE flaws get public exploits, patch now
  BleepingComputer · Jul 18, 2026
• Two new high severity WordPress vulnerabilities, patch immediately!
  Help Net Security · Jul 18, 2026
• New wp2shell RCE Vulnerability Hits Millions of WordPress Sites, Emergency Patch Released
  Cyber Security News · Jul 18, 2026
• PSA: WordPress Core Patched Unauthenticated Remote Code Execution Vulnerability Chain
  Wordfence Blog · Jul 17, 2026
• CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core
  Rapid7 Blog · Jul 17, 2026
• Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities
  Cloudflare Blog · Jul 17, 2026
• Unauthenticated SQL Injection in WordPress Core Fixed in 7.0.2
  Patchstack Blog · Jul 17, 2026
• WordPress 7.0.2 Release
  WordPress Core Security · Jul 17, 2026
• CISA Adds Four Known Exploited Vulnerabilities to Catalog
  CISA Alerts