Exploitation in the Wild of wp2shell

Wiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core (CVE-2026-63030 & CVE-2026-60137). Attackers are deploying persistent webshells on vulnerable servers. Organizations should prioritize patching or applying WAF mitigations.

These vulnerabilities comprise a critical pre-authentication remote code execution (RCE) chain in WordPress Core, dubbed "wp2shell",discoveredby Searchlight Cyber using OpenAI GPT 5.6 Sol, and published on July 17th, 2026. This exploit chain allows unauthenticated attackers to gain remote code execution on default WordPress installations in any WordPress version released since December 2025.

Our data indicates that 60% of organizations using WordPress initially had at least one vulnerable instance at the time these CVEs were published, and 25% were exposing a vulnerable server to the Internet. However, this figure is rapidly declining as organizations patch, lowering to 50% and 10% respectively within 24 hours of the initial publication.

Almost immediately following the vulnerability chain’s publication, many exploit POCs were made available by security researchers, most of which were limited to SQL injection on default WordPress configurations while allowing RCE under specific conditions. However, later POCs achieved RCE against arbitrary targets.

So far we’ve observed multiple actors successfully exploiting this vulnerability chain against WordPress instances self-hosted in the cloud. Following successful batch API exploitation, we’ve observed the following post-exploitation activities:

Malicious plugin upload- Attackers accessed/wp-admin/plugin-install.php?tab=uploadand successfully executedPOST /wp-admin/update.php?action=upload-plugin, to install persistent backdoors.

User enumeration- Attackers sent requests to/wp-json/wp/v2/users?context=editto harvest admin usernames and email addresses.

Local file inclusion attempts- Attackers performed LFI attacks viaadmin-ajax.php?template=../../../wp-config, targeting database credentials and authentication keys for exfiltration.

Admin panel access- Attackers accessed/wp-admin/and received HTTP 200 responses indicating successful authenticated sessions.

We’ve also observed high-volume scanning activity without subsequent post-exploitation, suggesting opportunistic mass-scanning campaigns seeking to identify vulnerable targets alongside legitimate security scanning activity. We have yet to identify lateral movement or data exfiltration, but we continue to monitor and investigate.

In terms of deployed malware, among our findings were two PHP webshells that represent opposite ends of the sophistication spectrum. The first was a minimal one-liner:

This is a bare-bones backdoor that provides remote code execution to anyone that knows the parameter name, and returns 404 as an evasion technique. We regularly see these types of webshells deployed following most new RCE vulnerabilities; they are one of the most common types of findings when investigating mass exploitation of an emerging vulnerability.

The second was a massive 150KB webshell disguised as a WordPress plugin called "CMSmap". Theoriginal legitimate pluginis a simple security tool, but this sample included a full-featured attack platform with a graphical interface, password authentication, and a broad set of capabilities including file management, database access, port scanning, batch code injection, and multiple privilege escalation modules including MySQL UDF exploitation.

The payload is obfuscated through hex-encoded string concatenation and gzip-compressed base64 encoding, unpacked at runtime viaeval(gzuncompress(base64_decode(...))).

The internal payload very closely matchesa known PHP webshellwith modified variables such as shellname and password.

A third malicious WordPress plugin we observed was also a PHP webshell. By registering a custom REST API endpoint (/morning/v1/[REDACTED]) with a permissive callback (__return_true), it allows attackers to send POST requests containing a base64-encoded command in the parameter. The plugin decodes and executes this command on the underlying server, capturing the output to return in a JSON response, effectively granting the attacker full command-level access:

The vulnerability abuses the WordPress REST API batch processing endpoints (/?rest_route=/batch/v1or/wp-json/batch/v1) to achieve unauthenticated code execution. From a detection standpoint, HTTP 207/200 Multi-Status responses to batch endpoint requests have proven to be a relatively high-fidelity indicator of successful exploitation (asobservedby Hexastrike as well), while user agent strings containingwp2shellandrezwp2shellhave also served as reliable tool signatures identifying purpose-built exploitation frameworks.

CVE-2026-63030 & CVE-2026-60137 (Full RCE Exploit Chain):

WordPress Core versions6.9.0through6.9.4

WordPress Core versions7.0.0through7.0.1

CVE-2026-60137 (SQLi):

WordPress Core versions6.8.0through6.8.5

Update WordPress to thevendor-fixed release.

As a temporary mitigation, organizations that cannot immediately update can restrict anonymous access to the WordPress Batch API by blocking the/wp-json/batch/v1endpoint (or?rest_route=/batch/v1) at a web application firewall (WAF), or by disabling anonymous REST API access using a plugin.

Wiz customers should refer tothe pre-built advisoryin the Wiz Threat Intel Center for actionable steps to investigate, remediate, and harden their environments. Wiz Research will continue to update that advisory as the situation develops.

Changelog (2026-07-22):Removed 45.79.167[.]238 from the IOC list as we confirmed it was a legitimate security scanner.

Part 3: How the Red Agent bypassed a credit and paywall system by changing a single client-side value from false to true.

Detect and mitigate malicious @asyncapi npm packages linked to the latest npm supply chain attack.

Rethinking IaC coverage as a funnel that shows how much of your infrastructure is governed, traceable, and ready for remediation at speed

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings