WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)

1. Executive summary

CVE-2026-63030 (CVSS 9.8 CRITICAL, CWE-436) is an unauthenticated remote code execution vulnerability in WordPress Core, exploited via the REST API batch endpoint. Active in-the-wild exploitation is confirmed by multiple sources (SANS ISC, Tenable, SecurityWeek, BleepingComputer) within days of the July 17 2026 disclosure, with public proof-of-concept exploits circulating. The flaw affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1; fixed in 6.9.5 and 7.0.2. EMEA financial services running self-managed WordPress installations for public-facing websites, blogs, or portals face immediate risk of complete server compromise, webshell deployment, and database tampering. The vulnerability is NOT currently listed in CISA KEV (EPSS 9%). Note: Rapid7's advisory quotes a CVSS of 7.5; the authoritative NVD record assigns 9.8 CRITICAL — we use the verified 9.8 throughout.

2. Regulatory framing

No NIS2 or UK NIS articles are specifically engaged beyond generic incident-response obligations, as no supply-chain-specific or third-party-specific trigger facts are present in this item.

3. Technical analysis & attack chain

Affected versions: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1. Fixed in 6.9.5, 7.0.2, and 7.1 Beta 2. Versions prior to 6.9 are NOT affected by CVE-2026-63030 (introduced in 6.9).

Chained CVE: CVE-2026-60137 (CVSS 5.9) — SQL injection in the author__not_in parameter of WP_Query, present in WordPress 6.8.0+. When chained with CVE-2026-63030 (REST API batch-route confusion), the two flaws enable unauthenticated pre-auth RCE. CVE-2026-63030 was introduced in WordPress 6.9, so the full RCE chain is only achievable on 6.9.x and 7.0.x. CVE-2026-60137 was discovered by researchers TF1T, dtro, and haongo; CVE-2026-63030 was discovered by Adam Kues of Searchlight Cyber. No MITRE ATT&CK actor profiles are associated with the exploitation at this time — attribution is unconfirmed.

Precondition: The WordPress REST API must be exposed. Cloudflare reports the vulnerable code path is reached when a persistent object cache is NOT in use. No plugins or themes are required — default WordPress configuration is exploitable.

Confirmed attack chain (from SANS ISC captured exploit)

1. Initial access — REST API batch endpoint. Attacker sends POST /?rest_route=/batch/v1 (or /wp-json/batch/v1) with Content-Type: application/json and User-Agent: cve-2026-63030/1.0. The batch request nests a sub-request targeting /wp/v2/posts.
2. SQL injection via author_exclude parameter. The batch route confusion (CVE-2026-63030) allows the attacker to reach the WP_Query SQL injection (CVE-2026-60137) through the author_exclude parameter on /wp/v2/posts/999999. The injected SQL uses UNION SELECT to break out of the original query: author_exclude=0) UNION SELECT 999999,2,0x323032302d30312d30312030303a30303a3030,...,0x706f7374,22,23-- +-
3. Vulnerability detection probe. The first UNION SELECT returns ||OK|| (hex-encoded 0x4f4b wrapped in 0x7c7c delimiters) to confirm SQL injection is working. Hex values decode to standard WordPress post fields (e.g., 0x7075626c697368 = publish, 0x706f7374 = post, 0x323032302d30312d30312030303a30303a3030 = 2020-01-01 00:00:00).
4. Webshell deployment via INTO OUTFILE. The second injected query writes a PHP webshell to disk: sql UNION SELECT '<?php error_reporting(0);@ini_set(\'display_errors\',0);$k="94uh9ubh6e1x";...?>' INTO OUTFILE '/var/www/wp-content/cache/94uh9ubh6e1x.php'
5. Webshell capabilities. The dropped file (94uh9ubh6e1x.php) is a command-execution webshell with the following characteristics: - Authentication key: Requires ?p=94uh9ubh6e1x parameter; returns a fake HTTP 404 page if the key is absent or incorrect ("Jedi error" — the page exists but returns 404). - Command delivery: Accepts commands via ?b= (base64-decoded using base64_decode, hex-obfuscated as \x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65) or ?c= (plaintext). - Execution functions (fallback chain): system() → passthru() → exec() → shell_exec() → popen() → backtick operator. Each is checked via function_exists() for PHP hardening bypass. - Output wrapping: Command output is delimited by [S] and [E] markers. If no command is provided, returns [S]OK[E].
6. Post-exploitation — admin user creation. The attacker subsequently created a new admin user in the WordPress database (confirmed by SANS ISC reader submission).

Exploitation scope: Honeypot detections began over the weekend of July 18–19. Hexastrike has assisted with incident response in several confirmed attacks. Patchstack has confirmed in-the-wild exploitation. Public PoC exploits are circulating (BleepingComputer, Tenable). ANSSI France (CERT-FR) issued alert CERTFR-2026-ALE-007 on July 20.

Single-sourced detail: The complete exploit payload and webshell analysis are sourced solely from the SANS ISC diary (one reader-submitted SecurityOnion capture). The webshell filename 94uh9ubh6e1x.php and key 94uh9ubh6e1x are from this single capture — verify before enforcement, as other actors may use different filenames/keys.

4. Mitigation & containment

P1 — Within 24 hours

• Patch immediately. Upgrade all internet-facing WordPress installations to 6.9.5 (6.9 branch) or 7.0.2 (7.0 branch). Verify that automatic updates have applied successfully — do not assume. WordPress is forcing updates for installations with auto-updates enabled, but self-managed installations require manual action.
• Check for compromise on any installation running 6.9.0–6.9.4 or 7.0.0–7.0.1 that had the REST API exposed between July 17 and patch date:
• Inspect /var/www/wp-content/cache/ (and any WordPress cache directory) for unexpected .php files. Remove any files not associated with legitimate caching plugins.
• Query the WordPress database for recently created admin users: SELECT user_login, user_registered FROM wp_users WHERE user_registered > '2026-07-17' ORDER BY user_registered DESC;
• Review web server access logs for POST requests to /?rest_route=/batch/v1 or /wp-json/batch/v1 with User-Agent: cve-2026-63030/1.0.
• Review logs for SQL injection patterns in author_exclude or author__not_in parameters containing UNION SELECT and INTO OUTFILE.

P2 — Within 72 hours

• Block the exploit vector at WAF/reverse proxy for any installation that cannot be immediately patched:
• Block or rate-limit requests to /wp-json/batch/v1 and /?rest_route=/batch/v1 from untrusted sources.
• Block requests with User-Agent: cve-2026-63030/1.0.
• Block SQL injection signatures matching UNION SELECT ... INTO OUTFILE in REST API parameters.
• Disable REST API if not required for business functionality (note: this may break plugins/themes that depend on it).
• Enable a persistent object cache (e.g., Redis, Memcached) — Cloudflare reports the vulnerable code path is reached when a persistent object cache is NOT in use. This is a mitigation, not a replacement for patching.
• Harden PHP by disabling system, passthru, exec, shell_exec, popen via php.ini disable_functions where web application functionality permits.

P3 — Within 7 days

• Asset inventory validation. Enumerate all WordPress installations across the organisation, including those managed by third-party hosting providers, marketing teams, or business units. Confirm patch status for each.
• File integrity monitoring. Deploy FIM on WordPress wp-content/cache/, wp-content/uploads/, and theme/plugin directories to alert on new .php file creation.
• Tabletop / purple-team exercise. Validate detection coverage for the SQLi-to-webshell pattern (REST API → UNION SELECT → INTO OUTFILE → webshell with 404 facade).

5. Indicators of compromise

filepath  /var/www/wp-content/cache/94uh9ubh6e1x.php
user-agent  cve-2026-63030/1.0
http-path  /?rest_route=/batch/v1
http-path  /wp-json/batch/v1
webshell-key  94uh9ubh6e1x

Behavioural indicators

6. Detection

rule wp2shell_webshell_94uh9ubh6e1x {
  meta:
    author = "Adverse Trace"
    date = "2026-07-20"
    reference = "https://isc.sans.edu/diary/rss/33168"
    description = "Detects wp2shell webshell dropped via CVE-2026-63030 exploit chain"
  strings:
    $key = "94uh9ubh6e1x" ascii
    $marker_s = "[S]" ascii
    $marker_e = "[E]" ascii
    $func_check = "function_exists" ascii
    $obf_base64 = "\\x62\\x61\\x73\\x65\\x36\\x34\\x5f\\x64\\x65\\x63\\x6f\\x64\\x65" ascii
    $obf_system = "\\x73\\x79\\x73\\x74\\x65\\x6d" ascii
    $obf_passthru = "\\x70\\x61\\x73\\x73\\x74\\x68\\x72\\x75" ascii
    $obf_exec = "\\x65\\x78\\x65\\x63" ascii
    $obf_shell_exec = "\\x73\\x68\\x65\\x6c\\x6c\\x5f\\x65\\x78\\x65\\x63" ascii
    $obf_popen = "\\x70\\x6f\\x70\\x65\\x6e" ascii
    $http404 = "404 Not Found" ascii
    $ini_display = "display_errors" ascii
  condition:
    $key and 2 of ($marker_s, $marker_e) and $func_check and 3 of ($obf_*) and $http404
}

title: Detect wp2shell REST API Batch Endpoint Exploitation CVE-2026-63030
id: 7a3c1f2e-2026-0720-4470-b3a1-9c8e5d4f2a01
status: experimental
description: Detects exploitation attempts targeting WordPress REST API batch endpoint with SQL injection patterns characteristic of CVE-2026-63030
author: Adverse Trace
date: 2026/07/20
references:

  - https://isc.sans.edu/diary/rss/33168
logsource:
  category: webserver
  product: apache
detection:
  selection_endpoint:
    c-uri|contains:

      - "/?rest_route=/batch/v1"
      - "/wp-json/batch/v1"
  selection_ua:
    c-user-agent|contains:

      - "cve-2026-63030/1.0"
  selection_sqli:
    c-uri|contains:

      - "UNION"
      - "INTO OUTFILE"
      - "author_exclude="
  condition: selection_endpoint and (selection_ua or selection_sqli)
falsepositives:

  - Legitimate batch API usage with unusual user agents (unlikely)
  - Security scanning tools testing for CVE-2026-63030
level: critical

title: Detect wp2shell Webshell Creation in WordPress Cache Directory
id: 8b4d2e3f-2026-0720-5581-c4b2-0d9f6e5g3b12
status: experimental
description: Detects creation of PHP files in WordPress wp-content/cache directory, consistent with wp2shell webshell deployment via INTO OUTFILE
author: Adverse Trace
date: 2026/07/20
references:

  - https://isc.sans.edu/diary/rss/33168
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:

      - "/wp-content/cache/"
  selection_ext:
    TargetFilename|endswith:

      - ".php"
  condition: selection_path and selection_ext
falsepositives:

  - Legitimate caching plugins writing PHP files to cache directory (verify against known plugin behaviour)
level: high

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• SANS ISC — "WordPress Exploitation Underway (CVE-2026-63030)" — https://isc.sans.edu/diary/rss/33168 — 2026-07-20
• Tenable Research — "wp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Core" — https://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution — 2026-07-20
• Rapid7 — "CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core" — https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core — 2026-07-17
• BleepingComputer — "WordPress Core 'wp2shell' RCE flaws get public exploits, patch now" — https://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/ — 2026-07-20
• Help Net Security — "Two new high severity WordPress vulnerabilities, patch immediately!" — https://www.helpnetsecurity.com/2026/07/18/wordpress-vulnerabilities-wp2shell-cve-2026-60137-cve-2026-60137/ — 2026-07-18
• SecurityWeek — "WP2Shell WordPress Vulnerabilities Exploited in the Wild" — https://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/ — 2026-07-20
• ANSSI France CERT — "Multiples vulnérabilités dans WordPress (20 juillet 2026)" — https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-007/ — 2026-07-20

8. Adverse Trace position

Severity: CRITICAL. CVE-2026-63030 (CVSS 9.8, CWE-436) is a pre-authentication RCE in WordPress Core — not a plugin — affecting default installations with no preconditions beyond REST API exposure. Active exploitation is multi-source corroborated (SANS ISC, Tenable, SecurityWeek, BleepingComputer, Patchstack, Hexastrike) with public PoC code circulating. The exploit chain is reliable, requires no authentication, and delivers a functional webshell with command execution and database manipulation capabilities. The Rapid7 advisory quotes CVSS 7.5; the authoritative NVD record assigns 9.8 CRITICAL — we assess at 9.8 per the verified reference data. The vulnerability is NOT in CISA KEV as of this advisory (EPSS 9%), though given the exploitation trajectory, KEV addition is likely. Attribution to any named threat actor is unconfirmed — no MITRE ATT&CK actor profiles are associated. The complete exploit payload and webshell IOC set are single-sourced from one SANS ISC reader submission; clients should treat the specific filename (94uh9ubh6e1x.php) and key (94uh9ubh6e1x) as representative, not exhaustive — other actors will use different values. Client impact: Any EMEA financial services organisation running self-managed WordPress 6.9.x–7.0.1 with internet-facing REST API exposure should treat this as an active incident — patch to 6.9.5/7.0.2 immediately and conduct retrospective compromise checks. Hosted/managed WordPress installations may have been auto-patched by providers; verify. Next steps: Adverse Trace will monitor for CISA KEV addition, track additional webshell variants as they emerge, and update IOCs as exploitation broadens beyond the initial single-sourced capture.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.