• 2 min read
WordPress wp2shell attacks are already dropping webshells
Attackers are exploiting the critical wp2shell WordPress flaws to install webshells and rogue plugins. Patched versions are 7.0.2, 6.9.5, and 6.8.6.
Image: BleepingComputer
Attackers are already exploiting the critical “wp2shell” vulnerability chain in WordPress Core to install persistent webshells and malicious plugins on vulnerable servers. The issues, tracked as CVE-2026-63030 and CVE-2026-60137, abuse the WordPress REST API batch-processing feature and can lead to remote code execution without authentication.
Proof-of-concept exploits began appearing over the weekend, shortly after SearchLight Cyber disclosed the flaws. Active exploitation was then confirmed after WordPress shipped fixes in versions 7.0.2, 6.9.5, and 6.8.6, triggering automatic security updates for supported sites.
Wiz says it observed attackers:
- mass-scanning for vulnerable WordPress sites
- abusing plugin upload features to install malicious add-ons
- dropping PHP webshells, including obfuscated shells disguised as plugins such as CMSmap
- querying the REST API for administrator usernames and email addresses
- attempting local file inclusion against wp-config via admin-ajax.php to steal database credentials and authentication keys
- deploying a malicious plugin that exposes a REST API endpoint for remote command execution
- successfully accessing WordPress admin panels
Wiz said it has not seen lateral movement or data exfiltration so far.
What defenders are seeing in the wild
A separate report from Johannes B. Ullrich, Dean of Research at Sans Technology Institute, describes two-stage attacks that first probe for SQL injection to verify the target is vulnerable, then deliver a PHP webshell. In observed cases, the shell was placed under /wp-content/cache/ and returned a fake 404 error when accessed. Ullrich also said some attackers are creating rogue administrator accounts.
Recommended reading
UK tests show top AI models still cheat
Malicious plugin installed on vulnerable sites Source: Wiz
Defiant said the first exploitation-related probing appeared at 23:29 UTC on July 17, with a clear SQL injection attempt arriving 13 minutes later.
Admins are being urged to update immediately, review logs for wp2shell-related requests, inspect installed plugins, and look for newly added PHP files or new admin users. Yutaka Sejiyama, a researcher at Macnica, has also published a live dashboard tracking patch adoption; it currently shows an 81.6% patch rate across a sample of 124,580 websites.
SearchLight Cyber researcher Adam Kues also published a follow-up report yesterday detailing how the team discovered wp2shell and built a working exploit chain, including the use of AI tools.
Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.
via BleepingComputer
