WordPress Under Attack: The Critical Vulnerability IT Doesn’t Know It Has

In this episode of IT SPARC Cast – CVE of the Week, John and Lou discuss WP2Shell, a critical WordPress remote code execution vulnerability chain (CVE-2026-63030 and CVE-2026-60137) that allows attackers to compromise default WordPress installations without authentication or plugins. Even though emergency patches were released quickly, thousands of vulnerable sites remain online—and many organizations may not even realize they’re running WordPress.

The discussion also explores the growing security risks posed by Shadow IT, why automatic updates are essential, and how services like…