WordPress Patches wp2shell Flaws After Webshell Exploitation
Summary
Attackers are exploiting WordPress flaws CVE-2026-63030 and CVE-2026-60137 via unauthenticated REST API requests to install webshells and malicious plugins. WordPress patched the flaws; Wiz reported no observed lateral movement or data exfiltration.
Key points
- The wp2shell flaws, CVE-2026-63030 and CVE-2026-60137, are being exploited through unauthenticated abuse of WordPress REST API batch processing.
- Wiz reported malicious plugin uploads, PHP webshell installations, administrator account and email enumeration, and local file inclusion attempts targeting wp-config.
- Ullrich described attacks that probe for SQL injection before delivering a PHP webshell under /wp-content/cache/; some attacks also create rogue administrator accounts.
- Wiz said it had not observed lateral movement or data exfiltration in the activity it monitored.
- WordPress issued patched versions 7.0.2, 6.9.5, and 6.8.6 and forced automatic security updates for supported installations.
- Administrators are advised to update, review logs and plugins, and check for suspicious PHP files and newly created administrator accounts.
- A patch-tracking dashboard reported an 81.6% patch rate among a sample of 124,580 websites.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution through abuse of the WordPress REST API batch-processing feature
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
T1136.001 · Local AccountSome attacks create rogue administrator accounts on affected WordPress sites.T1190 · Exploit Public-Facing ApplicationAttackers exploit the unauthenticated wp2shell vulnerabilities through the WordPress REST API to execute code on vulnerable installations.T1505.003 · Web ShellAttackers deploy persistent PHP webshells, including shells placed in the /wp-content/cache/ directory.
CVE
People
Adam KuesSearchLight Cyber researcher who published a report about discovering wp2shell and developing a working exploit chain.Johannes B. UllrichSANS Technology Institute Dean of Research who reported on observed two-stage wp2shell attacks and described the webshell behavior.Yutaka SejiyamaMacnica researcher who created a dashboard to track the live patch rate for affected websites.