WordPress wp2shell flaws exploited to deploy webshells

Hackers are actively exploiting a pair of critical vulnerabilities in WordPress Core, tracked as CVE-2026-63030 and CVE-2026-60137, to deploy persistent webshells and install malicious plugins on vulnerable servers. This exploit chain, collectively dubbed “wp2shell,” targets the WordPress REST API’s batch-processing feature, enabling remote attackers to execute code without authentication.

Proof-of-concept exploits surfaced over the weekend, shortly after SearchLight Cyber disclosed the vulnerabilities. Active exploitation was confirmed almost immediately after WordPress released patches in versions 7.0.2, 6.9.5, and 6.8.6, triggering automatic security updates for supported installations.

Wiz, a cloud security firm, shared detailed observations of ongoing attacks. Threat actors are mass-scanning for vulnerable sites, abusing the plugin upload functionality to install malicious add-ons, and deploying PHP webshells that range from simple one-liner backdoors to obfuscated shells disguised as legitimate plugins like CMSmap. Attackers are also querying the REST API to collect administrator usernames and email addresses, attempting local file inclusion via admin-ajax.php to steal database credentials and authentication keys, and deploying plugins that expose a REST API endpoint for remote command execution. Successful access to WordPress admin panels has been reported, though Wiz has not observed lateral movement or data exfiltration.

Johannes B. Ullrich, Dean of Research at SANS Technology Institute, described a two-stage attack pattern. The first stage probes SQL injection to confirm the vulnerability, followed by delivering a PHP webshell stored in the /wp-content/cache/ directory with a randomized filename. This filename also serves as a password, passed via a URL variable; otherwise, the page returns a fake 404 error. The webshell checks for available PHP functions like system(), passthru(), exec(), shell_exec(), popen(), and the backtick operator to execute commands. Ullrich noted that some attacks create rogue administrator accounts, urging site owners to inspect the cache directory and user lists.

Defiant, a WordPress security firm, reported the first exploitation probing at 23:29 UTC on July 17, with a clear SQL injection attempt just 13 minutes later. Administrators should immediately update to patched versions, review logs for wp2shell-related requests, inspect installed plugins, and check for rogue PHP files or new admin accounts.

A live patch rate dashboard by Macnica researcher Yutaka Sejiyama currently shows an 81.6% patch rate among 124,580 sampled websites. In a follow-up report, SearchLight Cyber’s Adam Kues detailed the discovery process and development of a working exploit chain, which involved using AI tools.