WP2Shell WordPress Exploit Technical Analysis and Real Attack Data

1. Executive summary

The "wp2shell" exploit chain combines two vulnerabilities in WordPress Core — CVE-2026-60137 (CVSS 5.9 MEDIUM, SQL Injection) and CVE-2026-63030 (CVSS 9.8 CRITICAL, REST API Batch-Route Confusion) — to achieve unauthenticated remote code execution (RCE) on default installations. Both CVEs were added to the CISA KEV catalog on 2026-07-21 and are actively exploited in the wild, with over 11 million blocked exploit attempts recorded by Wordfence alone. EMEA financial services running vulnerable, internet-facing WordPress instances (versions 6.9.0–6.9.4 and 7.0.0–7.0.1 for the full RCE chain; 6.8.0–6.8.5 for standalone SQLi) face immediate risk of complete system compromise, backdoor account creation, and web shell deployment.

2. Regulatory framing

3. Technical analysis & attack chain

The wp2shell chain exploits two vulnerabilities in WordPress Core. CVE-2026-63030 (CVSS 9.8 CRITICAL, CWE-436) is a REST API batch-route confusion flaw introduced in WordPress 6.9 that causes arrays containing sub-requests, validation results, and matched handlers to become misaligned. This desynchronization causes WordPress to treat all requests as trusted, including those that should be blocked. CVE-2026-60137 (CVSS 5.9 MEDIUM, CWE-89) is a SQL injection vulnerability in the author__not_in (also referenced as author_exclude) parameter of WP_Query, present in WordPress 6.8 and later. When chained on WordPress 6.9.0–7.0.1, these flaws allow an unauthenticated attacker to reach the REST API batch endpoint and achieve RCE. Note: the source text from The Register refers to CVE-2026-60137 as "moderate-severity" and CVE-2026-63030 as "critical"; the verified NVD data classifies CVE-2026-60137 as MEDIUM (CVSS 5.9) and CVE-2026-63030 as CRITICAL (CVSS 9.8), which is consistent.

Confirmed attack chain

1. Initial access — REST API batch endpoint: The attacker sends a crafted POST request to /?rest_route=/batch/v1 (or /wp-json/batch/v1) with Content-Type: application/json. The request nests batch sub-requests to exploit the route confusion, bypassing method restrictions and validation.
2. SQL injection primitive: The batch desynchronization allows attacker-controlled parameters to reach a REST route that would normally sanitize them. The attacker injects a SQLi payload via the author_exclude parameter on /wp/v2/widgets or /wp/v2/posts (e.g., /wp/v2/posts/999999?author_exclude=0) UNION SELECT ...). The SANS ISC capture shows a UNION-based injection that first tests for vulnerability by selecting ||OK|| as a marker, then delivers a payload that writes a PHP webshell via INTO OUTFILE or manipulates WordPress post/cache data.
3. Administrator account creation: The SQLi is used in a larger chain involving WordPress post caching, oEmbed cache rows, changesets, and action hooks. The attacker creates a new administrator account via a POST to /wp/v2/users with the body {"email": "wpenginebot@wpengine.com", "password": "[redacted]", "roles": ["administrator"], "username": "wpenginebot"}. Wordfence and watchTowr both observed this account creation in live attack data.
4. Code execution via plugin upload: Once authenticated as administrator, the attacker uploads a malicious plugin (a ZIP file containing a backdoor). Elastic Security Labs observed the Icex0 PoC creating plugin directories under wp-content/plugins/wp2shell_<hex>/, where <hex> is randomly generated per invocation.
5. Post-exploitation: The web shell executes commands through the web server runtime. Elastic Defend telemetry shows httpd, apache2, or php-fpm spawning a shell and running sh -c id as a common first confirmation command. watchTowr observed attackers deploying fake plugins to exfiltrate credentials/secrets and, in one case, attempting to download Overlord RAT (a Golang-based remote access trojan). SANS ISC documented webshells dropped outside the plugin directory under wp-content/cache/.

Affected versions

• WordPress 6.8.0–6.8.5: SQL injection only (CVE-2026-60137); no full RCE chain (CVE-2026-63030 not present). Fixed in 6.8.6.
• WordPress 6.9.0–6.9.4: Full pre-auth RCE chain. Fixed in 6.9.5.
• WordPress 7.0.0–7.0.1: Full pre-auth RCE chain. Fixed in 7.0.2.
• WordPress 7.1 Beta 1: Vulnerable. Fixed in 7.1 Beta 2.
• Versions prior to 6.8: Not affected.

Key technical notes

• Cloudflare notes the vulnerable code path is reached when a persistent object cache is NOT in use.
• The exploit requires no plugins, no themes, no authentication, and no user interaction. A default WordPress installation exposed to the public internet is sufficient.
• The WordPress Security Team enabled forced automatic updates for affected versions due to severity.
• watchTowr reported that exploitation began within hours of disclosure on July 17, 2026, initially using public exploit code to exfiltrate hashed credentials, with RCE following once additional details became public. VulnCheck verified more than two dozen unique PoC exploits by July 20.
• Attribution to specific threat actors is unconfirmed. No MITRE ATT&CK actor profiles are referenced in the verified data. watchTowr observed over 100 backdoor accounts created by different threat actors using variations of public tooling.

Confidence caveat: The account creation IOC (wpenginebot) and the Overlord RAT observation are single-sourced to watchTowr via The Register; verify before enforcement. The SANS ISC webshell payload is single-sourced from a reader submission.

4. Mitigation & containment

P1 — Within 24 hours

• Patch immediately. Update WordPress Core to 6.8.6 (6.8.x branch), 6.9.5 (6.9.x branch), or 7.0.2 (7.0.x branch). Verify at https://wp2shell.com whether your instance is vulnerable. Confirm that forced automatic updates have been applied if background updates are enabled.
• Audit administrator accounts. Review all WordPress users and remove any unknown administrator accounts, especially any created on or after July 17, 2026. Look specifically for the username wpenginebot. Note: attackers with admin access can clear their tracks, so absence of unknown accounts does not guarantee no compromise.
• Block or restrict the REST API batch endpoint. If patching cannot be completed immediately, block requests to /?rest_route=/batch/v1 and /wp-json/batch/v1 at the WAF, reverse proxy, or CDN layer. Cloudflare and Wordfence Premium have deployed protective rules.
• Isolate compromised hosts. If exploitation is confirmed, treat as full system compromise. Take the host offline, preserve forensic evidence (access logs, filesystem timeline), and rebuild from known-good media.

P2 — Within 72 hours

• Review access logs for requests to /wp-json/batch/v1 or /?rest_route=/batch/v1, particularly those with User-Agent: cve-2026-63030/1.0 or User-Agent: wp2shell (stock PoC identifiers). Also look for SQLi patterns in author_exclude or author__not_in parameters.
• Scan filesystem for web shells. Check wp-content/plugins/ for directories matching wp2shell_* and inspect wp-content/cache/ for unexpected PHP files. Look for PHP files containing base64_decode wrappers, system/passthru/exec call patterns, or the hardcoded key 94uh9ubh6e1x (from the SANS ISC payload).
• Rotate credentials. If compromise is suspected, rotate all WordPress administrator passwords, database credentials, and any secrets stored in wp-config.php. watchTowr observed credential exfiltration as an early attack objective.
• Verify WAF rules are active. If using Wordfence Free, the firewall rule for this vulnerability is not available until August 16, 2026. Deploy an alternative WAF rule or CDN-level protection in the interim.

P3 — Within 7 days

• Enable persistent object caching (e.g., Redis, Memcached) if feasible — Cloudflare notes the vulnerable code path is only reached when a persistent object cache is not in use.
• Harden REST API exposure. If the REST API is not required for site functionality, restrict access to authenticated users or specific endpoints via plugin or server configuration.
• Conduct retrospective compromise check. Review file integrity monitoring logs, PHP-FPM/Apache process spawning events, and web server access logs from July 17, 2026 onward for indicators of web shell activity (web server process spawning shell binaries).

5. Indicators of compromise

username  wpenginebot
email  wpenginebot@wpengine.com
user-agent  cve-2026-63030/1.0
user-agent  wp2shell
filepath  wp-content/plugins/wp2shell_<hex>/
filepath  wp-content/cache/
http_endpoint  /?rest_route=/batch/v1
http_endpoint  /wp-json/batch/v1
sqli_parameter  author_exclude
sqli_parameter  author__not_in
php_webshell_key  94uh9ubh6e1x
malware  Overlord RAT

6. Detection

rule WP2Shell_Webshell_Payload {
  meta:
    author = "Adverse Trace"
    date = "2026-07-29"
    reference = "https://isc.sans.edu/diary/rss/33168"
    description = "Detects PHP webshell payload delivered via wp2shell SQLi INTO OUTFILE, captured in the wild by SANS ISC"
  strings:
    $key = "94uh9ubh6e1x"
    $b64_var = "\\x62\\x61\\x73\\x65\\x36\\x34\\x5f\\x64\\x65\\x63\\x6f\\x64\\x65"
    $sys_var = "\\x73\\x79\\x73\\x74\\x65\\x6d"
    $pass_var = "\\x70\\x61\\x73\\x73\\x74\\x68\\x72\\x75"
    $exec_var = "\\x65\\x78\\x65\\x63"
    $param_p = "\"p\""
    $param_b = "\"b\""
    $param_c = "\"c\""
    $http_404 = "404 Not Found"
  condition:
    $key and ($b64_var or $sys_var or $pass_var or $exec_var) and 2 of ($param_p, $param_b, $param_c)
}

rule WP2Shell_Plugin_Directory {
  meta:
    author = "Adverse Trace"
    date = "2026-07-29"
    reference = "https://www.elastic.co/security-labs/wp2shell-wordpress-rce-detection-elastic-defend"
    description = "Detects wp2shell plugin directory naming pattern from Icex0 PoC"
  strings:
    $plugin_dir = "wp-content/plugins/wp2shell_"
  condition:
    $plugin_dir
}

title: WP2Shell REST API Batch Endpoint Exploitation Attempt
id: 7a3c1f2e-2026-4320-9a8b-c0ffee123456
status: experimental
description: >
  Detects HTTP requests targeting the WordPress REST API batch endpoint
  with patterns consistent with wp2shell exploitation (CVE-2026-63030 / CVE-2026-60137).
  Based on in-the-wild attack data from Wordfence, SANS ISC, and Elastic Security Labs.
author: Adverse Trace
date: 2026/07/29
references:

  - https://www.wordfence.com/blog/2026/07/wp2shell-wordpress-exploit-technical-analysis-and-real-attack-data/
  - https://isc.sans.edu/diary/rss/33168
  - https://www.elastic.co/security-labs/wp2shell-wordpress-rce-detection-elastic-defend
logsource:
  category: webserver
detection:
  selection_endpoint:
    c-uri|contains:

      - "/?rest_route=/batch/v1"
      - "/wp-json/batch/v1"
  selection_ua_poc:
    c-user-agent|contains:

      - "cve-2026-63030/1.0"
      - "wp2shell"
  selection_sqli_param:
    c-uri|contains:

      - "author_exclude="
      - "author__not_in="
  selection_sqli_pattern:
    c-uri|contains:

      - "UNION SELECT"
      - "UNION+SELECT"
  filter_legitimate:
    c-user-agent|contains:

      - "WordPress/"
  condition: (selection_endpoint and (selection_ua_poc or selection_sqli_param or selection_sqli_pattern)) and not filter_legitimate
fields:

  - c-ip
  - c-user-agent
  - c-uri
  - c-method
  - sc-status
falsepositives:

  - Legitimate batch API usage by WordPress plugins or integrations (would not typically contain SQLi patterns or PoC user-agents)
level: high

title: WP2Shell Web Server Process Spawning Shell
id: 8b4d2a3f-2026-4320-a9c1-d00cafe98765
status: experimental
description: >
  Detects web server processes (httpd, apache2, php-fpm) spawning shell binaries,
  consistent with wp2shell post-exploitation behavior observed by Elastic Defend.
author: Adverse Trace
date: 2026/07/29
references:

  - https://www.elastic.co/security-labs/wp2shell-wordpress-rce-detection-elastic-defend
logsource:
  category: process_creation
  product: linux
detection:
  selection_webserver:
    ParentImage|endswith:

      - "/httpd"
      - "/apache2"
      - "/php-fpm"
  selection_shell:
    Image|endswith:

      - "/sh"
      - "/bash"
      - "/dash"
      - "/zsh"
  selection_first_cmd:
    CommandLine|contains:

      - "id"
  condition: selection_webserver and selection_shell
fields:

  - ParentImage
  - Image
  - CommandLine
  - User
falsepositives:

  - Legitimate server-side scripts that intentionally execute shell commands (review parent process and command context)
level: high

CVE assessment

2 referenced CVEs — 2 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• Wordfence — "WP2Shell WordPress Exploit Technical Analysis and Real Attack Data" — https://www.wordfence.com/blog/2026/07/wp2shell-wordpress-exploit-technical-analysis-and-real-attack-data/ — 2026-07-29
• Wordfence — "wp2shell Aftermath: The First Critical Unauthenticated WordPress Core RCE in Nearly a Decade" — https://www.wordfence.com/blog/2026/07/wp2shell-aftermath-the-first-critical-unauthenticated-wordpress-core-rce-in-nearly-a-decade/ — 2026-07
• The Register — "Attackers pummel critical WordPress vuln to create all sorts of mischief" — https://www.theregister.com/security/2026/07/20/attackers-pummel-critical-wordpress-vuln-to-create-all-sorts-of-mischief/5275265 — 2026-07-20
• SANS Internet Storm Center — "WordPress Exploitation Underway (CVE-2026-63030)" — https://isc.sans.edu/diary/rss/33168 — 2026-07-20
• Tenable Research — "wp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Core" — https://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution — 2026-07
• Elastic Security Labs — "wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution" — https://www.elastic.co/security-labs/wp2shell-wordpress-rce-detection-elastic-defend — 2026-07
• CISA KEV / NVD — CVE-2026-60137 — https://nvd.nist.gov/vuln/detail/CVE-2026-60137 — added 2026-07-21

8. Adverse Trace position

This is a genuinely critical vulnerability chain in the most widely deployed CMS on the internet. Both CVEs are CISA KEV-listed with active exploitation confirmed by multiple independent sources (Wordfence, watchTowr, Patchstack, VulnCheck, SANS ISC, Elastic). The attack requires no preconditions beyond internet exposure of a default WordPress installation. For EMEA financial services, the risk is acute for any institution running self-managed WordPress for public-facing sites, marketing portals, or internal documentation — these are often outside the core security perimeter and may not have received the forced automatic update. The WordPress Security Team's rapid response and forced auto-update mechanism has likely limited the blast radius, but any instance that did not auto-update (custom configurations, hosting provider restrictions, manual deployments) remains exposed. We assess with high confidence that exploitation will continue and broaden as PoC tooling proliferates. Clients should immediately inventory all WordPress instances, verify patch status, and treat any unpatched internet-facing instance as potentially compromised. We will continue monitoring for confirmed financial-sector compromises and updated IOCs.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.