Researchers found two new WordPress vulnerabilities (CVE-2026-60137 and CVE-2026-63030) that, when chained together, result in Remote Code Execution (RCE). This chained attack has been dubbed "wp2shell". In this post we look at what the attack means for WordPress users, and how running WordPress in a hardened container can dramatically shrink the blast radius of attacks like this one.
WordPress users should update immediately, as exploits are already in the wild. If you don't have automatic updates turned on, stop reading this post — log in to your admin dashboard and update now.
The Impact of wp2shell
This vulnerability is serious. Anonymous attackers can gain full control over stock WordPress installations. They can extract admin passwords, change pages and files, run shell commands, and pivot to attack anything else the install has access to. The attack does not depend on vulnerable configurations or plugins and does not require attackers to have existing credentials.
For installs inside Virtual Machines (VMs), the attacker will get access to all the files and tooling in the VM. This may include data and tooling for other applications installed on the VM. They may also be able to pivot and use the VM's access to further infiltrate the network. Recovery is also onerous: it typically means wiping the VM and rebuilding from scratch.
Shrinking the Blast Radius with Containers
At Chainguard, we provide hardened container images for WordPress. We shipped a fixed image as soon as WordPress released the update, providing our users with as much time as possible to update. While containerization does not prevent this exploit, it can greatly reduce the blast radius. For example, if you had installed WordPress following the distroless instructions (also shown in this video), the attacker would have been severely curtailed in what they could do; they would not be able to install plugins, access shell tooling, or modify the file system. In particular, the distroless image combined with a read-only file system would have prevented the common attacker process of uploading malicious add-ons and installing PHP webshells. Recovering from exploitation is also simpler; by default, updates replace the container rather than updating in place, so all that should be needed is the normal update process plus restoring the database from a known-clean backup. This does mean you will lose changes since the last backup, but it is much less painful than rebuilding a VM.
If you are running WordPress in a container, you must keep it up to date — containerized versions of WordPress are still at risk. We recommend using Dependabot or Renovate. By default, these tools will open a PR for updates, but you can also configure them to automatically apply updates. Consider allowing patch updates (i.e., going from 7.0.1 to 7.0.2) to happen automatically, with minor or major changes going through the PR and approval process. Make sure that your image source (be it Chainguard or elsewhere) gets updates out promptly -- check how long it took them to release 7.0.2 and whether you're happy with their timelines.
AIee! There's more to come
Another interesting aspect of this attack is the use of AI in discovery. The researcher used GPT5.6 Sol in Ultra mode with a prompt based on the one used to prove a mathematical conjecture. The exploit cost around $25 to find, but would have been worth far more on the black market. It is also not a trivial finding; although WordPress may not have the best security history, the code that was breached had been thoroughly checked and reviewed.
At the same time, we know that Anthropic has provided "critical infrastructure" organizations with access to the Mythos model under Project Glasswing. Organizations with access to models like these have started reporting findings to "clearinghouses" such as Athena, which have been created to coordinate the mitigation and disclosure of those findings. wp2shell likely gives us an indication of the sort of vulnerabilities we can expect to see filtering out of these clearinghouses in the coming weeks and months. The coming months will be a severe test for our industry.
In other words, AI-assisted discovery means more wp2shells are coming. All organizations should be looking at their security posture — minimal, hardened containers may not prevent every attack, but as shown in this case, they significantly reduce the blast radius.
Check out Chainguard’s free WordPress image if you’re looking to upgrade.
Share this article
Related articles
- security
Responding to the Five Eyes guidance on AI and cyber risk
Chris Carty, Enterprise Solutions Engineer
- security
AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026)
Quincy Castro, CISO
- security
We're putting our security to the test, and we want your help
Quincy Castro, CISO, and Alex Burrage, Director, Product Security
- security
Summer of Clearinghouses
Dan Lorenc, Co-founder and CEO
- security
@mastra npm scope takeover: 143 packages backdoored via compromised contributor account
Quincy Castro, CISO
- security
Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions hijack CI/CD pipelines via binding.gyp
Quincy Castro, CISO