<\/span><\/h3>\nThe ‘wp2shell’ exploit chain is a sophisticated, two-part attack that bypasses standard security measures in WordPress. At its core, the vulnerability allows unauthenticated attackers to achieve SQL injection through a single HTTP request on default WordPress installations. This capability is particularly concerning as it affects any WordPress version released since December 2025.<\/p>\n
CVE-2026-60137: The Gateway<\/strong><\/p>\nThe initial entry point for this attack is CVE-2026-60137, a route confusion bug within the WordPress REST API’s batch endpoint. This flaw allows attackers to invoke internal handlers without undergoing any authentication checks, effectively bypassing security protocols. Ben Marr, a security engineer at Intruder, explained that this vulnerability stems from the improper sanitization of the ‘author__not_in’ parameter within the ‘WP_Query’ function. When untrusted data is passed to this parameter, potentially through a plugin or theme, it can lead to the alteration of database queries. This manipulation can result in unauthorized access to sensitive data or even the modification of existing information.<\/p>\n
CVE-2026-63030: The Remote Code Execution Enabler<\/strong><\/p>\nWhile CVE-2026-60137 provides the initial unauthorized access, CVE-2026-63030 is the critical component that enables remote code execution (RCE). According to Cloudflare, this RCE capability is only realized when persistent object caching is not actively in use on the WordPress installation. The SQL injection vulnerability (CVE-2026-60137) has been present in WordPress versions from 6.8 onwards. However, the subsequent RCE vulnerability (CVE-2026-63030) specifically impacts versions from 6.9 and later, making a broad range of modern WordPress sites susceptible.<\/p>\n
The combination of these two vulnerabilities creates a potent attack vector. An unauthenticated attacker can send a specially crafted request to a vulnerable WordPress site, exploiting the REST API route confusion to inject malicious SQL queries. These queries, in turn, can be manipulated to trigger the remote code execution flaw, granting the attacker the ability to run arbitrary commands on the server.<\/p>\n<\/span>Timeline of Exploitation and Discovery<\/span><\/h3>\nThe timeline of events surrounding the ‘wp2shell’ vulnerabilities highlights a rapid escalation from discovery to widespread exploitation.<\/p>\n
\nPre-December 2025:<\/strong> The foundational vulnerability, CVE-2026-60137, is introduced into WordPress versions from 6.8 onwards due to issues with parameter sanitization.<\/li>\nDecember 2025:<\/strong> WordPress version 6.9 is released, incorporating the RCE vulnerability, CVE-2026-63030. This version, along with subsequent releases, becomes susceptible to the combined ‘wp2shell’ exploit chain.<\/li>\nOver 10 Hours Prior to Saturday (UTC):<\/strong> Researchers at Searchlight Cyber, utilizing OpenAI’s GPT 5.6 Sol, discover the exploit chain. Their investigation into exploit brokers paying significant sums for WordPress RCE vulnerabilities leads them to this critical discovery. Technical details are deliberately withheld due to the severe implications.<\/li>\nEarly Hours of Saturday (UTC):<\/strong> Exploitation of the ‘wp2shell’ vulnerabilities commences. Initial attacks focus on exfiltrating hashed credentials, a common precursor to more damaging actions.<\/li>\nAs Public Exploit Code Emerges:<\/strong> Following the release of more detailed exploit information, attackers rapidly transition to leveraging the full remote code execution capabilities of the vulnerabilities.<\/li>\nSaturday and Ongoing:<\/strong> Security researchers and intelligence firms begin to observe and report on the widespread nature of the attacks. Telemetry data indicates exploitation originating from multiple countries, and companies like Wiz report significant percentages of organizations having vulnerable instances exposed.<\/li>\nOngoing Monitoring:<\/strong> Security firms like Wiz and WatchTowr continue to monitor post-exploitation activities, identifying the creation of backdoor accounts, the deployment of malicious plugins, and attempts to install advanced persistent threats (APTs) like Overlord RAT.<\/li>\n<\/ul>\n<\/span>Supporting Data and Global Impact<\/span><\/h3>\nThe reach and severity of the ‘wp2shell’ exploitation are being underscored by various data points from security researchers and intelligence platforms.<\/p>\n
Geographical Distribution of Exploitation:<\/strong>Vulnerability Prevalence:<\/strong>Exploitation Volume:<\/strong>Post-Exploitation Activities:<\/strong>\nWeb Shell Deployment:<\/strong> A 150 KB web shell, disguised as a legitimate WordPress security plugin named CMSmap, has been observed. This malicious tool functions as a "full-featured attack platform," offering capabilities such as file management, direct database access, port scanning, batch code injection, and the deployment of multiple privilege escalation modules, including MySQL UDF exploitation.<\/li>\nBackdoor Administrator Accounts:<\/strong> Following successful exploitation, attackers have been creating backdoor administrator accounts on compromised WordPress sites. Over 100 such accounts have been identified. These accounts serve as persistent entry points for attackers, allowing them to deploy fake WordPress plugins or download further malicious tools to deepen their compromise.<\/li>\nTargeted Malware Deployment:<\/strong> In at least one documented instance, a threat actor has been observed repeatedly attempting to install Overlord RAT, a sophisticated Golang-based remote access trojan. The deployment of such RATs suggests a move towards establishing long-term control and data exfiltration capabilities.<\/li>\nOpportunistic Scanning:<\/strong> Wiz researchers also noted high-volume scanning activity that did not necessarily lead to immediate post-exploitation. This suggests that attackers are not only actively exploiting known vulnerabilities but also conducting mass-scanning campaigns to identify potential targets for future attacks, possibly alongside legitimate security scanning operations.<\/li>\n<\/ul>\n<\/span>Statements and Reactions from Security Experts<\/span><\/h3>\nThe severity of the ‘wp2shell’ vulnerabilities has prompted reactions from prominent figures and organizations within the cybersecurity community.<\/p>\n
Jake Knott, principal security researcher at watchTowr, emphasized the rapid progression of the attack: "By the early hours of Saturday morning (UTC), successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public. From our vantage point across a global client base, we are seeing widespread impact of this vulnerability across organizations of every size and every vertical."<\/p>\nSearchlight Cyber, the firm that initially discovered the exploit chain with the assistance of AI, highlighted the ease of exploitation: "The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins," they stated. This underscores the low barrier to entry for attackers and the significant risk to even minimally configured WordPress sites.<\/p>\n
The researchers at Wiz, Shahar Dorfman and Gili Tikochinski, provided critical insights into post-exploitation activities, noting the ongoing monitoring efforts: "We have yet to identify lateral movement or data exfiltration, but we continue to monitor and investigate." Their cautious optimism, coupled with continued vigilance, reflects the dynamic nature of cyber threats.<\/p>\n
<\/span>Broader Implications and Defense Strategies<\/span><\/h3>\nThe ‘wp2shell’ attack chain represents a significant threat to the vast ecosystem of websites powered by WordPress, which accounts for a substantial portion of the internet’s online presence. The ability for unauthenticated remote code execution fundamentally undermines the security of these platforms, opening them up to a wide array of malicious activities.<\/p>\n
Implications:<\/strong><\/p>\n\nData Breaches:<\/strong> Compromised WordPress sites can be used to steal sensitive customer data, financial information, and intellectual property.<\/li>\nWebsite Defacement and Disruption:<\/strong> Attackers can alter website content, redirect traffic, or bring websites offline entirely, causing significant reputational and financial damage.<\/li>\nMalware Distribution:<\/strong> Vulnerable sites can be repurposed to host and distribute malware, phishing kits, or ransomware to unsuspecting visitors.<\/li>\nBotnet Participation:<\/strong> Compromised servers can be enlisted into botnets for conducting further attacks, such as Distributed Denial of Service (DDoS) attacks, or for cryptocurrency mining.<\/li>\nSupply Chain Attacks:<\/strong> If a compromised WordPress site is used by businesses as part of their operations or supply chain, it can serve as an entry point for attacks against their partners or clients.<\/li>\n<\/ul>\nDefense and Mitigation:<\/strong>\nImmediate Patching:<\/strong> The most critical step is to update WordPress to the latest secure version as soon as possible. This will address the underlying vulnerabilities.<\/li>\nSecurity Audits:<\/strong> Organizations should conduct thorough security audits of their WordPress instances. This includes:\n\nReviewing Administrator Accounts:<\/strong> Inspecting for any newly created or unauthorized administrator accounts.<\/li>\nScanning for Malicious Plugins:<\/strong> Identifying and removing any suspicious or unknown plugins that may have been installed.<\/li>\nChecking for Suspicious Files:<\/strong> Searching for any unusual files or modifications within the WordPress directory structure.<\/li>\n<\/ul>\n<\/li>\nWeb Application Firewalls (WAFs):<\/strong> Implementing and configuring a robust WAF can help detect and block malicious traffic, including exploit attempts targeting these vulnerabilities.<\/li>\nPersistent Object Cache:<\/strong> For sites using WordPress version 6.9 or later, ensuring that persistent object caching is enabled can help mitigate the RCE aspect of the vulnerability, although patching remains the definitive solution.<\/li>\nSecurity Plugins:<\/strong> Utilizing reputable WordPress security plugins can provide an additional layer of defense, offering features like malware scanning, intrusion detection, and brute-force protection.<\/li>\nRegular Backups:<\/strong> Maintaining regular, off-site backups of WordPress websites is crucial. In the event of a compromise, these backups can be used to restore the site to a clean state.<\/li>\nMonitoring and Alerting:<\/strong> Implementing comprehensive monitoring and alerting systems can help detect anomalous activity and alert administrators to potential breaches in real-time.<\/li>\n<\/ol>\nThe ‘wp2shell’ vulnerabilities serve as a stark reminder of the persistent threats facing web platforms and the critical importance of maintaining up-to-date security measures. The rapid exploitation of these flaws underscores the need for proactive defense strategies and swift responses to emerging cyber threats.<\/p>\n","protected":false},"excerpt":{"rendered":"
Attackers have initiated widespread exploitation of two critical vulnerabilities within the WordPress content management system, collectively known as ‘wp2shell’. These flaws, identified as CVE-2026-63030 and CVE-2026-60137, can be chained together to grant unauthenticated attackers the ability to execute remote code and gain complete control over vulnerable websites. The exploitation began as early as Saturday morning …<\/p>\n","protected":false},"author":10,"featured_media":6680,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[108],"tags":[669,1001,109,2806,1273,606,111,1376,110,2805,3129,2807,365,2754,2753],"class_list":["post-6681","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-protection","tag-code","tag-compromise","tag-cybersecurity","tag-enable","tag-execution","tag-mass","tag-privacy","tag-remote","tag-security","tag-shell","tag-siege","tag-unauthenticated","tag-vulnerabilities","tag-websites","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/posts\/6681","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6681"}],"version-history":[{"count":0,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/posts\/6681\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/media\/6680"}],"wp:attachment":[{"href":"https:\/\/lockitsoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6681"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6681"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6681"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}