WP2Shell (CVE-2026-63030): Is Your WordPress Site Already Hacked? How to Check and Fix It

If you run a WordPress site, stop what you're doing and check your version number. There is a live, unauthenticated remote-code-execution flaw in WordPress core itself — no vulnerable plugin required