Barely three days after disclosure, attackers are widely chaining together CVE-2026-60137 and CVE-2026-63030 to lob exploit attempts against one of the largest attack surfaces on the Internet.
'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover
Summary + source link. No paywalls, no tracking.