Attackers have rapidly begun to leverage two severe vulnerabilities within the WordPress content management system that, when combined, create an exploit chain capable of achieving unauthenticated remote code execution (RCE) and subsequently, complete compromise of affected websites. These critical security flaws, officially tracked as CVE-2026-63030 and CVE-2026-60137, have been collectively codenamed "wp2shell" by the cybersecurity community, highlighting the ease with which a web shell can be established on vulnerable systems. The swift transition from vulnerability disclosure to active exploitation underscores the urgency for website administrators to apply necessary patches and implement robust security measures.
Understanding the ‘wp2shell’ Threat: A Deeper Dive into the Vulnerabilities
The "wp2shell" exploit chain is a sophisticated attack that leverages two distinct but interconnected vulnerabilities. The first, CVE-2026-60137, is an SQL injection (SQLi) flaw. This vulnerability serves as the initial entry point, allowing attackers to manipulate database queries. The second, CVE-2026-63030, then escalates this access to achieve remote code execution, granting full control over the compromised server. The combination of these two flaws is particularly dangerous because it requires no prior authentication, meaning an anonymous attacker can initiate the exploit on a default WordPress installation, even without any third-party plugins.
WordPress, powering over 40% of all websites on the internet, is an immensely popular and powerful content management system. Its widespread adoption, however, also makes it a prime target for malicious actors. A Remote Code Execution (RCE) vulnerability is among the most severe types of flaws, as it allows an attacker to execute arbitrary commands on the server hosting the application. This could lead to a myriad of devastating consequences, including data theft, website defacement, the installation of malware, complete server takeover, or using the compromised server as a platform for further attacks. SQL injection, on the other hand, is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g., to dump database content to the attacker). In the context of wp2shell, the SQLi flaw is critical for bypassing authentication mechanisms and preparing the ground for the RCE.
Security researchers at watchTowr confirmed the immediate and widespread nature of the threat. Jake Knott, principal security researcher at watchTowr, stated, "By the early hours of Saturday morning (UTC), successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public." He further emphasized the pervasive impact: "From our vantage point across a global client base, we are seeing widespread impact of this vulnerability across organizations of every size and every vertical." This global reach suggests that attackers are indiscriminately scanning the internet for vulnerable targets, making no distinction between small personal blogs and large enterprise websites.
Chronology of Discovery and Escalating Exploitation
The discovery of this critical exploit chain highlights the evolving landscape of cybersecurity research, particularly the increasing role of artificial intelligence. The "wp2shell" exploit was initially identified by Searchlight Cyber using OpenAI GPT 5.6 Sol, an advanced AI model, a process that reportedly took over 10 hours. This achievement underscores the potential for AI to accelerate vulnerability discovery, a double-edged sword that benefits both defenders and attackers. While technical details regarding the specific methods employed by the AI for discovery have been largely withheld due to the severity and ongoing nature of the issue, this marks a significant milestone in AI-assisted security research.
The SQL injection vulnerability (CVE-2026-60137) is present in WordPress versions from 6.8 onwards, while the RCE component (CVE-2026-63030) affects versions from 6.9. The combined exploit chain is effective against any WordPress version released since December 2025. This timeline means a substantial portion of currently deployed WordPress installations could be at risk if not promptly updated.
The transition from discovery to active exploitation was remarkably swift. Following the initial disclosure and the subsequent release of public exploit code, threat actors wasted no time in weaponizing the vulnerabilities. Telemetry data collected by KEVIntel paints a clear picture of this global assault, showing that at least 13 unique IP addresses, originating from diverse geographical locations including Switzerland, Germany, the U.K., Indonesia, Lithuania, the Netherlands, and Singapore, have been linked to the exploitation of CVE-2026-63030. This geographical spread indicates a coordinated or at least rapidly disseminated attack strategy, where various groups or individuals are leveraging the available exploit tools.
Cloudflare, a leading internet infrastructure and security company, provided further technical clarification, noting that CVE-2026-63030 enables unauthenticated remote code execution only when a persistent object cache is not in use. This detail is crucial for defenders, as it suggests that certain caching configurations might offer a degree of mitigation, though not a complete solution.
Technical Breakdown of the Exploit Mechanism
The intricate nature of the "wp2shell" exploit lies in its two-stage attack. Ben Marr, a security engineer at Intruder, provided a detailed explanation of the exploit chain. He described it as utilizing "a two-part vulnerability chain to achieve unauthenticated SQL injection on a stock WordPress installation with a single HTTP request."
The first component, CVE-2026-60137, acts as the crucial entry point. This vulnerability stems from a "route confusion bug in the REST API batch endpoint that bypasses authentication, allowing an attacker to invoke internal handlers without any permission check." Essentially, a flaw in how the WordPress REST API processes batch requests allows an attacker to trick the system into executing internal functions that should typically require authentication, without actually providing valid credentials.
Building upon this authentication bypass, the attack then targets the "improper sanitization of the ‘author__not_in’ parameter within ‘WP_Query’ when untrusted data is passed to it by a plugin or theme." The WP_Query class is a fundamental component of WordPress, used for querying posts and other content from the database. By injecting malicious data into the author__not_in parameter, which is typically used to exclude posts by specific authors, the attacker can alter the underlying SQL database query. This alteration can lead to unauthorized access to or manipulation of data, laying the groundwork for the more severe RCE. While the exact technical steps to achieve RCE from this SQLi are complex and have been responsibly withheld, the combined effect is a complete compromise of the system. Searchlight Cyber emphasized the severity by stating, "The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins," highlighting the critical nature of the default installation’s susceptibility.
Observed Post-Exploitation Activities and Broader Impact
The aftermath of successful exploitation paints a concerning picture of attacker objectives. Google-owned Wiz, a cloud security subsidiary, has been closely monitoring the situation. Their data indicated that at the time these CVEs were published, a staggering 60% of organizations utilizing WordPress had at least one vulnerable instance, with 25% exposing a vulnerable server directly to the internet. While these figures have reportedly dropped as organizations scramble to apply fixes, the initial exposure rate underscores the vast attack surface presented by WordPress installations.
Wiz researchers Shahar Dorfman and Gili Tikochinski detailed several post-exploitation activities observed after the abuse of the two flaws:
- Web Shell Deployment: A significant observation is the deployment of a 150 KB web shell. This shell is cunningly disguised as a legitimate WordPress security plugin named "CMSmap," attempting to blend in with legitimate system files. This web shell is not a simple script but a "full-featured attack platform," providing attackers with extensive capabilities including file management, direct database access, port scanning functionalities, batch code injection, and multiple privilege escalation modules, such as MySQL User-Defined Function (UDF) exploitation. This level of sophistication indicates that attackers are not merely seeking fleeting access but aiming for persistent and deep control over compromised systems.
- Backdoor Administrator Accounts: More than 100 backdoor administrator accounts have been created on compromised sites. These accounts provide persistent access for attackers, allowing them to bypass normal authentication mechanisms even if initial entry points are patched. From these backdoor accounts, attackers can deploy fake WordPress plugins, which serve as a convenient vector for further code execution or for downloading secondary tools to deepen their control over the system.
- Malware Deployment Attempts: In at least one documented instance, a threat actor was observed repeatedly attempting to install "Overlord RAT," a Golang-based remote access trojan. The deployment of a sophisticated RAT like Overlord indicates an intent to establish long-term, covert control over the compromised server, potentially for data exfiltration, creating botnets, or launching further attacks.
- Mass Scanning Campaigns: Beyond targeted exploitation, security firms have noted high-volume scanning activity across the internet. WatchTowr reported "tens of thousands of exploitation attempts" registered on its honeypots following the release of a public exploit. Wiz researchers also observed "high-volume scanning activity without subsequent post-exploitation, suggesting opportunistic mass-scanning campaigns seeking to identify vulnerable targets alongside legitimate security scanning activity." This suggests that a broad range of attackers, from highly skilled groups to automated botnets, are actively seeking to capitalize on these vulnerabilities.
Despite these widespread exploitation attempts, Wiz researchers stated, "We have yet to identify lateral movement or data exfiltration, but we continue to monitor and investigate." This ongoing monitoring is crucial for understanding the full scope and impact of these breaches.
Official Responses and Recommendations for Defenders
The rapid and widespread exploitation of the "wp2shell" vulnerabilities necessitates an urgent and comprehensive response from website administrators and the broader cybersecurity community. While specific official statements from the WordPress Foundation itself were not detailed in the initial reports, the typical response to such critical vulnerabilities involves the swift release of security patches and advisories urging all users to update their installations immediately.
For defenders, the immediate priority is to apply all available security updates to their WordPress installations. However, given the evidence of successful exploitation and the creation of backdoor accounts and web shells, patching alone may not be sufficient. A thorough post-compromise inspection is paramount. Defenders are strongly recommended to:
- Inspect WordPress Instances: Meticulously examine their WordPress sites for any signs of compromise. This includes checking for newly created administrator accounts that were not authorized, identifying any malicious or unfamiliar plugins, and scanning for suspicious files or modifications within the WordPress core directories and plugins/themes folders. Tools capable of detecting web shells or known malware signatures should be employed.
- Review Server Logs: Scrutinize web server logs (e.g., Apache, Nginx), WordPress access logs, and error logs for any unusual activity, such as unexplained HTTP requests to the REST API endpoints, unusual file uploads, or outbound connections to unknown IP addresses.
- Implement Web Application Firewalls (WAFs): A robust WAF can provide an additional layer of defense by detecting and blocking malicious requests before they reach the WordPress application. While not a substitute for patching, a WAF can mitigate ongoing attacks and provide valuable telemetry.
- Utilize Persistent Object Caching: As noted by Cloudflare, the RCE component (CVE-2026-63030) is only exploitable when persistent object caching is not in use. Where feasible, implementing or configuring persistent object caching can help mitigate the RCE aspect of the exploit chain.
- Strengthen Access Controls: Ensure strong, unique passwords for all WordPress user accounts, especially administrators. Implement multi-factor authentication (MFA) wherever possible.
- Regular Backups: Maintain regular, secure backups of both WordPress files and databases. In the event of a successful compromise, a clean backup can be critical for restoration.
- Security Audits: Conduct periodic security audits of WordPress installations and underlying server infrastructure to identify and address potential weaknesses proactively.
- Stay Informed: Continuously monitor security advisories from WordPress, cybersecurity vendors, and reputable news sources to remain aware of emerging threats and recommended countermeasures.
The discovery of "wp2shell" underscores the continuous cat-and-mouse game between attackers and defenders in the digital realm. The involvement of AI in vulnerability discovery marks a new era, presenting both unprecedented challenges and opportunities for improving cybersecurity. For the millions of websites powered by WordPress, this event serves as a stark reminder that proactive and diligent security practices are not merely best practices but essential for survival in an increasingly hostile online environment. The ongoing monitoring by security firms and the rapid response from the community will be crucial in containing this threat and helping organizations secure their digital assets against sophisticated and evolving attacks.
