Critical wp2shell WordPress flaws exploited to install webshells

Summary

Hackers are actively exploiting critical vulnerabilities in WordPress Core, dubbed 'wp2shell' (CVE-2026-63030 and CVE-2026-60137), to deploy webshells and malicious plugins. The exploit chain abuses the WordPress REST API's batch-processing feature, allowing unauthenticated remote code execution. While WordPress has released patches, active exploitation has been confirmed, with attackers scanning for vulnerable sites, uploading malicious add-ons, and attempting to steal credentials.

Full text

Critical wp2shell WordPress flaws exploited to install webshells By Bill Toulas July 21, 2026 12:41 PM 0 Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. The critical exploit chain abuses the WordPress REST API’s batch-processing feature, allowing remote attackers to execute code on vulnerable installations without the need to authenticate. Although the technical details were not released, proof-of-concept exploits started to emerge over the weekend, shortly after threat intelligence and cyber risk management company SearchLight Cyber disclosed the wp2shell security issue. Active exploitation was quickly confirmed, immediately after WordPress addressed the problem in versions 7.0.2, 6.9.5, and 6.8.6, forcing automatic security updates for supported installations. Cloud security company Wiz has shared technical details about observed attacks leveraging wp2shell, saying that threat actors performed the following activities: Mass-scanning for vulnerable WordPress installations (much of it is security scanning). Abuse of WordPress plugin upload functionality to install malicious add-ons. Installation of PHP webshells ranging from simple one-liner backdoors to feature-rich, obfuscated shells disguised as plugins (CMSmap). Querying the WordPress REST API to collect administrator usernames and email addresses. Local file inclusion attempts targeting wp-config through admin-ajax.php to retrieve database credentials and authentication keys. Deployment of a malicious plugin exposing a REST API endpoint for remote command execution Successful access to WordPress administration panels. Wiz says it has not observed lateral movement or data exfiltration but continues to monitor the threat activity. Malicious plugin installed on vulnerable sitesSource: Wiz A separate report on active wp2shell exploitation from Johannes B. Ullrich, Dean of Research at Sans Technology Insitute, describes two-stage attacks that start with probing SQL injection to confirm the vulnerability before delivering a PHP webshell to the server. The webshell was created under the /wp-content/cache/ directory with a randomized filename that was also used as a password to access it via variable in an URL request; otherwise, the page returned a fake 404 page. The webshell code that Ullrich published checked the availability of several PHP functions - system(), passthru(), exec(), shell_exec(), popen(), or the backtick operator, in an attempt to execute commands. According to Ullrich, some attacks also involve creating rogue administrator accounts. As such, the researcher recommends checking the /cache/ directory and looking for newly created users. WordPress security firm Defiant has also published an “aftermath” post stating that the first exploitation-related probing was observed at 23:29 UTC on July 17, followed by a clear SQL injection attempt just 13 minutes later. Administrators of WordPress sites should immediately update to the patched versions, review logs for wp2shell-related requests, inspect installed plugins, and check for rogue PHP file additions or newly created admin accounts. Macnica researcher Yutaka Sejiyama has created a dashboard that helps track the patch rate live. The portal reports an 81.6% patch rate out of a sample of 124,580 websites evaluated. Yesterday, SearchLight Cyber researcher Adam Kues published a follow-up report diving deep into the process of discovering wp2shell and developing a working exploit chain, which involved using AI tools. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: WordPress Core "wp2shell" RCE flaws get public exploits, patch nowHackers exploit info disclosure bug in Gravity SMTP WordPress pluginCritical Everest Forms Pro flaw exploited to take over WordPress sitesWP Maps Pro bug exploited to create admin accounts on WordPress sitesAustralia warns of global campaign targeting vulnerable CMS platforms

Indicators of Compromise

• cve — CVE-2026-63030
• cve — CVE-2026-60137

Entities