Listen to this Post
Introduction: A New Wake-Up Call for the WordPress Ecosystem
WordPress powers a significant portion of the modern internet, making it one of the most attractive targets for cybercriminals. Every major vulnerability discovered in its core software has the potential to affect millions of websites ranging from personal blogs to enterprise platforms. In recent months, cybersecurity researchers have repeatedly warned that attackers are becoming faster at weaponizing newly disclosed vulnerabilities, often launching attacks within hours of public disclosure. The latest wp2shell exploit chain is another example of this dangerous trend, demonstrating how quickly threat actors can move from proof-of-concept research to real-world exploitation.
The discovery of CVE-2026-63030 and CVE-2026-60137 has triggered widespread concern across the cybersecurity community. These vulnerabilities allow attackers to compromise vulnerable WordPress installations remotely without authentication, opening the door to persistent malware, hidden webshells, malicious plugins, and complete server compromise. Organizations that delay patching even briefly could unknowingly provide cybercriminals with long-term access to their infrastructure.
Critical wp2shell Vulnerabilities Are Already Being Exploited
Security researchers have confirmed that hackers are actively exploiting the newly discovered wp2shell vulnerability chain affecting WordPress Core.
The attack combines CVE-2026-63030 with CVE-2026-60137, abusing weaknesses inside WordPress’ REST API batch-processing functionality. The exploit enables attackers to execute arbitrary PHP code remotely without requiring valid credentials.
Unlike many WordPress attacks that depend on vulnerable plugins or stolen administrator accounts, this vulnerability exists inside WordPress Core itself, dramatically increasing the potential impact across the internet.
Attackers Began Weaponizing the Vulnerabilities Almost Immediately
Threat intelligence company SearchLight Cyber disclosed the security issue, but technical exploit details remained undisclosed initially.
That secrecy did not last long.
Within a single weekend, proof-of-concept exploit code started circulating among researchers and threat actors alike. Shortly afterward, security vendors confirmed active exploitation against live websites worldwide.
WordPress responded rapidly by releasing emergency security updates:
WordPress 7.0.2
WordPress 6.9.5
WordPress 6.8.6
Supported installations automatically received security updates, significantly reducing exposure for many administrators who enabled automatic updates.
How the wp2shell Attack Works
The exploit chain abuses the WordPress REST
Once attackers identify a vulnerable installation, they can execute malicious PHP code remotely and establish persistence without ever logging into the website.
Researchers observed attackers performing several coordinated activities including:
Internet-wide scanning for vulnerable WordPress websites.
Uploading malicious plugins.
Installing hidden PHP webshells.
Collecting administrator usernames.
Harvesting administrator email addresses.
Attempting Local File Inclusion attacks.
Reading sensitive wp-config configuration data.
Stealing authentication keys.
Deploying malicious REST API endpoints for future remote command execution.
Successfully accessing WordPress administration panels.
The campaign demonstrates a highly organized attack workflow rather than opportunistic exploitation.
Persistent Webshells Give Attackers Long-Term Access
One of the most dangerous aspects of the campaign is the deployment of PHP webshells.
Researchers observed multiple variants ranging from simple one-line backdoors to heavily obfuscated shells disguised as legitimate WordPress plugins.
These webshells allow attackers to:
Execute arbitrary commands
Upload additional malware
Modify website content
Install ransomware
Create hidden administrator accounts
Maintain persistence even after passwords are changed
Once installed, removing the initial vulnerability alone is no longer sufficient because the attackers already possess an alternative entry point.
Fake Plugins Are Becoming the Perfect Disguise
Rather than dropping suspicious executable files, many attackers simply install malicious plugins.
Since WordPress websites often contain dozens of legitimate plugins, malicious additions can remain unnoticed for weeks or even months.
Some observed plugins expose hidden REST API endpoints that accept remote commands directly from attackers.
To administrators, everything appears perfectly normal while attackers silently maintain full control over the website.
Researchers Observe Sophisticated Multi-Stage Attacks
Johannes B. Ullrich from the SANS Technology Institute documented a two-stage attack process.
The attacks begin by probing SQL injection opportunities to verify whether the target is exploitable.
Once confirmed, attackers deploy PHP webshells into:
/wp-content/cache/
Interestingly, visiting the malicious file directly often returns a fake 404 Not Found page.
This deception hides the webshell from casual inspection while allowing attackers to interact with it using specially crafted requests.
Hidden Administrator Accounts Increase Persistence
Some attack campaigns go beyond malware deployment.
Researchers discovered attackers creating rogue administrator accounts after successful exploitation.
These accounts provide an alternative method of regaining access even if malware is later removed.
Administrators should therefore audit:
Newly created administrator users
Unexpected privilege changes
Recently modified authentication settings
Finding an unfamiliar administrator account should be treated as evidence of compromise.
Defiant Documents the First Moments of the Attack Campaign
WordPress security company Defiant tracked the early stages of exploitation.
Their telemetry revealed suspicious probing activity beginning at 23:29 UTC on July 17.
Only thirteen minutes later, researchers detected the first confirmed SQL injection attempts associated with wp2shell.
This extremely short timeline highlights a growing cybersecurity reality:
Modern attackers no longer wait days or weeks after vulnerability disclosure—they often launch attacks within minutes.
Current Patch Adoption Shows Encouraging Progress
Security researcher Yutaka Sejiyama from Macnica developed a live dashboard monitoring patch adoption.
Current statistics indicate:
Approximately 81.6% of monitored WordPress websites have already installed security updates.
The sample includes over 124,580 evaluated websites.
Although encouraging, the remaining unpatched systems still represent tens of thousands of potential targets.
For automated attack campaigns, that number is more than enough.
Immediate Incident Response Recommendations
Organizations running WordPress should perform immediate incident response activities.
Recommended actions include:
Update WordPress immediately.
Review server logs for wp2shell exploitation attempts.
Inspect installed plugins.
Search for unknown PHP files.
Review the /wp-content/cache/ directory.
Remove unauthorized administrator accounts.
Rotate passwords and authentication keys.
Regenerate WordPress security salts.
Review REST API activity.
Monitor outbound connections from the server.
Even fully patched systems should be audited if they remained vulnerable before updates were installed.
Deep Analysis
The wp2shell campaign demonstrates how rapidly modern exploitation evolves from vulnerability disclosure to mass compromise. Unlike plugin-specific flaws, these vulnerabilities target WordPress Core, meaning a vast number of websites share the same attack surface. Automated scanners can identify vulnerable hosts within minutes, making delayed patching increasingly risky.
Another notable characteristic is the
Security teams should incorporate continuous monitoring and threat hunting alongside regular updates. Simply applying patches after exploitation may not remove hidden backdoors.
Useful Incident Response Commands
Search recently modified PHP files:
find /var/www/html -type f -name ".php" -mtime -7
Locate suspicious webshells inside the cache directory:
find wp-content/cache -type f -name ".php"
Search for dangerous PHP execution functions:
grep -R "eval|base64_decode|system|shell_exec|exec|passthru" wp-content/
List recently installed plugins:
ls -lt wp-content/plugins/
Audit WordPress administrator accounts (WP-CLI):
wp user list --role=administrator
Check file integrity using WP-CLI:
wp core verify-checksums
Review Apache access logs for suspicious REST API requests:
grep "wp-json" /var/log/apache2/access.log
Review Nginx access logs:
grep "wp-json" /var/log/nginx/access.log
Search for unexpected writable PHP files:
find . -perm -002 -name ".php" What Undercode Say:
The wp2shell incident is another reminder that the cybersecurity landscape has fundamentally changed.
Attackers no longer wait for detailed exploit documentation.
Artificial intelligence is accelerating exploit development.
Automation allows attackers to scan millions of websites every day.
WordPress remains the
That popularity also makes it the largest attack surface.
The most dangerous aspect is authentication bypass.
No stolen password is required.
No phishing campaign is necessary.
Remote execution dramatically lowers the attack barrier.
Persistent webshells remain one of the most effective post-exploitation tools.
Malicious plugins blend naturally into WordPress environments.
Administrators often overlook them.
Attackers increasingly prioritize persistence over immediate destruction.
Hidden administrator accounts extend compromise.
REST APIs continue expanding application functionality.
Unfortunately, they also expand attack surfaces.
Organizations should continuously monitor REST API activity.
File integrity monitoring should become standard practice.
Automated patching is no longer optional.
Threat intelligence must become operational rather than informational.
Security teams should assume compromise until proven otherwise.
Detection capabilities matter as much as prevention.
Regular threat hunting is essential.
Server logs often reveal early indicators.
Configuration files deserve special protection.
Least-privilege access reduces overall risk.
Security plugins alone cannot stop core vulnerabilities.
Endpoint Detection and Response should extend to web servers.
Continuous vulnerability management is critical.
Backup integrity must be verified regularly.
Incident response plans should include WordPress-specific procedures.
AI-assisted exploit development will likely shorten future attack timelines even further.
Organizations must prepare for vulnerabilities being exploited within hours—not days.
Zero Trust principles remain highly relevant.
Defense-in-depth continues to outperform single-layer security.
Security awareness should extend beyond desktop environments to web infrastructure teams.
The 81.6% patch rate is encouraging but leaves thousands of systems exposed.
Cybercriminals need only one vulnerable server to succeed.
Defenders must secure every exposed asset.
Speed has become the defining factor in modern cybersecurity.
The organizations that detect and respond first will suffer the least damage.
✅ Confirmed: WordPress released patched versions 7.0.2, 6.9.5, and 6.8.6 to address the wp2shell vulnerability chain, and active exploitation was observed shortly after the fixes became available.
✅ Confirmed: Multiple security organizations, including SearchLight Cyber, Wiz, Defiant, SANS Technology Institute, and Macnica researchers, independently documented exploitation attempts, webshell deployment, malicious plugin installation, and attacker reconnaissance activities, reinforcing the credibility of the reported threat.
✅ Confirmed: Current evidence indicates attackers are primarily focused on establishing persistence through webshells, rogue administrator accounts, and malicious plugins. Researchers have not yet reported widespread lateral movement or large-scale data exfiltration directly linked to the observed wp2shell campaigns, though monitoring remains ongoing.
Prediction
(+1) WordPress will likely introduce additional hardening around its REST API, strengthen input validation, and expand automated security protections in future releases to reduce the likelihood of similar exploit chains. Security vendors are also expected to improve detection signatures for wp2shell-related activity, enabling faster identification of compromised websites.
(-1) Cybercriminal groups will continue to automate exploitation of unpatched WordPress installations, and abandoned or poorly maintained websites may remain infected for months. As AI-assisted exploit development becomes more common, the window between vulnerability disclosure and active attacks is expected to shrink even further, making rapid patch management an essential requirement rather than a best practice.
▶️ Related Video (78% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub (Possible Sources for article):
https://www.discord.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
