![\"Critical](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2026\/07\/WordPress.jpg\")
<\/p>\n<\/p>\n
Hackers are exploiting the “wp2shell” critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers.<\/p>\n
The critical exploit chain<\/a> abuses the WordPress REST API\u2019s batch-processing feature, allowing remote attackers to execute code on vulnerable installations without the need to authenticate.<\/p>\n Although the technical details were not released, proof-of-concept exploits started to emerge over the weekend, shortly after threat intelligence and cyber risk management company SearchLight Cyber disclosed the wp2shell security issue.<\/p>\n Active exploitation was quickly confirmed, immediately after WordPress addressed the problem in versions 7.0.2, 6.9.5, and 6.8.6, forcing automatic security updates for supported installations.<\/p>\n Cloud security company Wiz has shared technical details about observed attacks leveraging wp2shell, saying that threat actors performed the following activities:<\/p>\n Mass-scanning for vulnerable WordPress installations (much of it is security scanning).
Wiz says<\/a> it has not observed lateral movement or data exfiltration but continues to monitor the threat activity.<\/p>\n A separate report on active wp2shell exploitation from Johannes B. Ullrich<\/a>, Dean of Research at Sans Technology Insitute, describes two-stage attacks that start with probing SQL injection to confirm the vulnerability before delivering a PHP webshell to the server.<\/p>\n The webshell was created under the \/wp-content\/cache\/ directory with a randomized filename that was also used as a password to access it via variable in an URL request; otherwise, the page returned a\u00a0fake 404 page.<\/p>\n The webshell code that Ullrich published checked the availability of several PHP functions\u00a0– system(), passthru(), exec(), shell_exec(), popen(), or the backtick operator, in an attempt to execute commands.<\/p>\n According to Ullrich, some attacks also involve creating rogue administrator accounts. As such, the researcher recommends checking the \/cache\/ directory and looking for newly created users.<\/p>\n WordPress security firm Defiant has also published an \u201caftermath\u201d post<\/a> stating that the first exploitation-related probing was observed at 23:29 UTC on July 17, followed by a clear SQL injection attempt just 13 minutes later.<\/p>\n Administrators of WordPress sites should immediately update to the patched versions, review logs for wp2shell-related requests, inspect installed plugins, and check for rogue PHP file additions or newly created admin accounts.<\/p>\n Macnica researcher Yutaka Sejiyama has created a dashboard<\/a> that helps track the patch rate live. The portal reports an 81.6% patch rate out of a sample of 124,580 websites evaluated.<\/p>\n Yesterday, SearchLight Cyber researcher Adam Kues published a follow-up report diving deep<\/a> into the process of discovering wp2shell and developing a working exploit chain, which involved using AI tools.<\/p>\n![\"image\"](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2026\/07\/ti-97.jpg\")
<\/a><\/p>\n
\n\tAbuse of WordPress plugin upload functionality to install malicious add-ons.
\n\tInstallation of PHP webshells ranging from simple one-liner backdoors to feature-rich, obfuscated shells disguised as plugins (CMSmap).
\n\tQuerying the WordPress REST API to collect administrator usernames and email addresses.
\n\tLocal file inclusion attempts targeting wp-config through admin-ajax.php to retrieve database credentials and authentication keys.
\n\tDeployment of a malicious plugin exposing a REST API endpoint for remote command execution
\n\tSuccessful access to WordPress administration panels.
<\/p>\n![\"Malicious](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2026\/07\/plugin.jpg\")
Malicious plugin installed on vulnerable sites
Source: Wiz<\/p>\n
![\"article](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2026\/06\/bas-report.jpg\")
<\/a><\/p>\n