WordPress wp2shell flaws exploited for webshells

What Happened

Threat actors are actively exploiting two critical vulnerabilities in WordPress Core, collectively tracked as “wp2shell” - CVE-2026-60137 and CVE-2026-63030. These flaws enable attackers to bypass authentication and achieve remote code execution, allowing them to install persistent webshells and inject malicious plugins onto affected sites. Security researchers observed a surge in exploitation attempts following the public release of proof-of-concept code, with multiple threat groups leveraging the vulnerability chain to compromise unpatched WordPress installations.

Why It Matters

WordPress powers over 43% of all websites on the internet, making these vulnerabilities a critical risk for organizations of all sizes. The wp2shell exploit chain bypasses standard security controls like web application firewalls (WAFs) by exploiting core database and API layers that many security tools do not inspect deeply. Once a webshell is deployed, attackers gain persistent access that can be used to pivot to connected systems, exfiltrate sensitive data, or use compromised sites for malicious redirects and phishing campaigns. The exploitation has been observed targeting high-traffic sites including e-commerce platforms, media outlets, and educational institutions, amplifying the potential for reputational and financial harm.

Technical Details

The attack chain works in two stages. First, CVE-2026-60137 is a time-based blind SQL injection vulnerability in WordPress’s database query handling, allowing an unauthenticated attacker to extract authentication tokens and craft valid session cookies. With access to a privileged session, the attacker moves to the second stage: CVE-2026-63030, which abuses a deserialization flaw in the WordPress REST API to achieve remote code execution. The final payload writes a webshell disguised as a legitimate WordPress plugin file (typically named wp-utils.php) and injects a second malicious plugin into the wp-content/plugins directory. Affected versions include WordPress 6.x releases up to and including 6.7.2. Indicators of compromise include unexpected plugin files in wp-content/plugins/, base64-encoded strings in wp-config.php, and outbound connections to known C2 infrastructure.

Immediate Risk

The risk is critical and urgent. The exploitation technique is straightforward to replicate with publicly available tooling, and scanning for vulnerable WordPress instances is simple via Shodan or masscan. Any WordPress site running version 6.7.2 or earlier that has not applied the April security patch is at immediate risk of complete compromise. Organizations should treat this as a response priority - a compromised webshell can evade detection for weeks, enabling attackers to use the site as a pivot point or to serve malware to visitors. Patches were released in WordPress 6.7.3 and 6.8.0.

Security Insight

The wp2shell attack chain illustrates a troubling trend: vulnerability chaining that moves from SQL injection to RCE to persistence is becoming the standard rather than the exception for high-value CMS platforms. Organizations should treat WordPress core as a critical application and implement runtime application self-protection (RASP) or web application firewall rules that inspect for deserialization patterns in REST API requests, not just classic SQL injection and XSS signatures. The similarity of this attack pattern to the 2021 TheCartPress privilege escalation chain (CVE-2021-47932) underscores how attackers now routinely combine plugin and core vulnerabilities to achieve persistence. Defenders should audit their WordPress deployment for any plugins that create administrator accounts or modify file permissions as an early warning indicator of lateral movement.

Further Reading

• WordPress SQLi exploited in the wild (CVE-2026-60137) [PoC]
• WordPress REST API unauth RCE (CVE-2026-63030) [PoC]
• WordPress TheCartPress creates admin accounts (CVE-2021-47932)
• Latest Security News
• CVE Advisories
• Data Breach Reports