Attackers Exploit Critical WordPress wp2shell RCE Vulnerabilities

Summary

Wiz reports active exploitation of the wp2shell vulnerability chain affecting WordPress Core, with attackers installing webshells and scanning for vulnerable servers. Users should update or restrict anonymous access to the Batch API.

Key points

CVE-2026-63030 and CVE-2026-60137 form a pre-authentication RCE chain affecting WordPress Core 6.9.0–6.9.4 and 7.0.0–7.0.1; CVE-2026-60137 also enables SQL injection in versions 6.8.0–6.8.5.
Wiz observed successful exploitation of cloud-hosted WordPress instances, including malicious plugin uploads, attempts to enumerate users and access configuration files, and authenticated admin-panel sessions.
Attackers deployed PHP webshells, including a backdoor disguised as the CMSmap plugin and a malicious plugin exposing command execution through a REST API endpoint.
Wiz has not identified lateral movement or data exfiltration; it also observed high-volume scanning without subsequent post-exploitation.
HTTP 200 or 207 responses to Batch API requests and user-agent strings containing “wp2shell” or “rezwp2shell” can help identify exploitation.
Update WordPress to the vendor-fixed release. As a temporary measure, restrict anonymous access to the Batch API endpoint through a WAF or by disabling anonymous REST API access.

Article Details

Vulnerability Types: Pre-authentication remote code execution
SQL injection
Severity: Critical
Affected Versions: WordPress Core 6.9.0 through 6.9.4
WordPress Core 7.0.0 through 7.0.1
WordPress Core 6.8.0 through 6.8.5 (CVE-2026-60137 SQL injection)
Exploitation Status: active
Exploit Availability: public_poc
Patch Status: available
Workarounds: Restrict anonymous access to the WordPress Batch API by blocking /wp-json/batch/v1 or ?rest_route=/batch/v1 at a web application firewall.
Disable anonymous REST API access using a plugin.

Indicators of compromise

Type	Indicator	Context
IPV4	`15[.]157[.]135[.]170`	IP address identified as used for exploitation.
IPV4	`172[.]235[.]128[.]52`	IP address identified as used for mass scanning.
IPV4	`34[.]81[.]132[.]62`	IP address identified as used for exploitation.
IPV4	`79[.]177[.]131[.]206`	IP address identified as used for exploitation.
IPV4	`94[.]100[.]52[.]128`	IP address identified as used for exploitation.
SHA1	`58eca847e9eae9e6b08cc211f1559817b71bc4cc`	Hash identified as a PHP webshell.
SHA1	`d9a220c8039f1c4d72cae7ccb8b3a33dec8815be`	Hash identified as a PHP webshell.
SHA1	`e9756e2338f84746007235e4cab7a70d5b3ca47f`	Hash identified as a PHP webshell.
SHA1	`ebea44890f434d5d67ede22009a3f4bb5cac33f8`	Hash identified as a PHP webshell.