Critical WordPress Flaws Create Perfect Storm for Website Takeovers

A Double Threat to WordPress Websites

Security researchers have discovered a dangerous combination of two separate security weaknesses in WordPress, the platform that powers nearly half of all websites on the internet. When attackers chain these flaws together, they can break into a website completely and take total control—without ever needing a password or login credentials. The vulnerabilities have been labeled CVE-2026-63030 and CVE-2026-60137, and researchers are calling this dangerous pairing "wp2she."

What makes this situation particularly urgent is that the attack works on undefended websites. Think of it like discovering that a building has two doors that, when used together in sequence, bypass the security guard entirely. A hacker exploiting these flaws can inject malicious code directly into affected servers, potentially installing spyware, stealing data, or taking the entire website offline.

The threat has already expanded beyond theoretical danger. Real-world attackers are weaponizing these vulnerabilities in active campaigns. One emerging threat uses a type of malware called ENCFORGE, which specifically hunts for and corrupts artificial intelligence model files stored through a tool called Langflow. This targeting suggests attackers are now deliberately going after businesses working with AI systems.

Why This Matters to Your Business

WordPress isn't just used by bloggers and small businesses—major corporations, media outlets, and government organizations rely on it. A successful attack through these vulnerabilities gives hackers the ability to:

• Steal sensitive customer information and business data
• Inject hidden code that attacks your website visitors
• Damage or destroy valuable files, including AI models and databases
• Use your website as a launching point for attacks on other targets
• Take your business offline during critical periods

The damage isn't limited to the business being attacked. When a website gets compromised this way, visitors can unknowingly download malware onto their own devices. This transforms your website from a business asset into a liability.

Protecting Yourself Now

If you operate a WordPress website, immediate action is necessary:

• Update immediately: Install all available WordPress security patches the moment they become available. Check your WordPress dashboard for pending updates today.
• Install security plugins: Tools that scan for vulnerabilities and monitor suspicious activity provide an extra layer of protection.
• Limit access: Disable user registration on your website if you don't need it, and restrict administrative access to only trusted individuals.
• Backup your files: Create regular copies of your entire website stored separately from your main server. This protects you if an attack succeeds.
• Monitor activity: Review your website logs regularly for suspicious login attempts or unusual file modifications.
• Use strong authentication: Enable two-factor authentication for all administrator accounts—this means hackers need both your password and a code from your phone to access your account.

For AI users specifically: If you're using Langflow or similar AI tools, prioritize backing up your trained models and ensure your systems receive updates the moment vendors release them.

Website security isn't a one-time task but an ongoing responsibility—stay vigilant and stay updated.