CVE-2026-60137

CVSS

—

EPSS

0.059 (93.0th percentile)

CISA KEV

Added 2026-07-21, due 2026-08-04

Exploitation

No report

Public exploits

11 repositories

State

Unknown

Coverage

• 

  ● Actively exploitedCritical 85Wiz Research20 Jul, 18:00

  Exploitation in the Wild of wp2shell

  Wiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core (CVE-2026-63030 & CVE-2026-60137). Attackers are deploying persistent webshells on vulnerable servers. Organizations should prioritize patching or applying WAF mitigations.

  ↗wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60…(opens the publisher's site in a new tab)

What we observed

1. 24 Sept, 12:29poc publishedpoc-in-github
2. 24 Sept, 12:15poc publishedpoc-in-github
3. 24 Sept, 11:52poc publishedpoc-in-github
4. 24 Sept, 11:50kev addedcisa-kev