Cybercriminals are actively exploiting the ‘wp2shell’ critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) in the WordPress core to deploy persistent web shells and install malicious plugins on compromised servers.
This significant exploit chain takes advantage of the batch processing capabilities of the WordPress REST API, enabling remote attackers to execute code on vulnerable installations without requiring authentication.
Although detailed technical information has not yet been disclosed, proof-of-concept exploits started surfacing after threat intelligence and cyber risk management firm SearchLight Cyber revealed security vulnerabilities related to wp2shell over the weekend.
An active exploit was identified shortly after WordPress released updates in versions 7.0.2, 6.9.5, and 6.8.6, followed by automatic security updates for supported installations.
Cloud security firm Wiz provided insights regarding an observed attack leveraging wp2shell, detailing that the threat actor conducted the following actions:
- Conducted bulk scans on vulnerable WordPress installations (predominantly security scans).
- Abused the upload functionality of WordPress plugins to install malicious add-ons.
- Installed PHP web shells, ranging from simple backdoors to sophisticated obfuscated shells disguised as plugins (CMSmap).
- Retrieved administrator usernames and email addresses via the WordPress REST API.
- Attempted local file inclusion to access wp-config through admin-ajax.php for database credentials and authentication keys.
- Introduced malicious plugins that exposed REST API endpoints for remote command execution.
- Gained unauthorized access to the WordPress admin panel.
Wiz reports that, while lateral movement or data exfiltration has not been observed, active threat monitoring is ongoing.
Source: Wiz
Further reports on active wp2shell exploitation by Johannes B. Ulrich, Director of Research at Sans Technology Institute, describe a two-step attack starting with SQL injection checks before deploying the PHP web shell to the server.
The web shell is created in the /wp-content/cache/ directory, utilizing randomized filenames as passwords for access via URL requests; otherwise, it returns a deceptive 404 error page.
The web shell code published by Ullrich checks for several PHP functions, including system(), passthrough(), exec(), shell_exec(), popen(), and the backtick operator to execute commands.
Some variations of the attack also involve creating fake administrator accounts. To mitigate risks, researchers advise examining the /cache/ directory for new users.
WordPress security firm Defiant also reported “Aftermath”, stating the first exploit was detected on July 17th at 23:29 UTC, followed by an evident SQL injection attempt just 13 minutes later.
Administrators of WordPress sites are urged to promptly update to the patched versions, review logs for wp2shell-related requests, inspect installed plugins, and monitor for any malicious PHP file additions or newly created administrator accounts.
Macnica researcher Yutaka Sechiyama created a dashboard for tracking live patch rates, reporting an 81.6% patch rate from a sample of 124,580 websites surveyed.
Recently, SearchLight Cyber researcher Adam Kues published a tracking report that dives deep into the discovery of wp2shell and the development of a working exploit chain utilizing AI tools.
Security teams have documented 54% of successful attacks and issued warnings for only 14%. The remaining incidents often go undetected.
Picus’ whitepaper reveals how to test your SIEM and EDR rules in breach and attack simulations to enhance threat detection.
Source: www.bleepingcomputer.com