Security Intelligence
Loading table of contents...
At a glance:
-
An active campaign is targeting two WordPress Core vulnerabilities enabling adversaries to fully compromise public-facing sites.
-
Exploitation has already resulted in webshell deployment, malicious plugin uploads, and credential theft, with scanning rapidly expanding after public PoC release.
-
Immediately update WordPress Core, review logs for signs of compromise, restrict the exposed endpoint, hunt for malicious PHP files, and strengthen monitoring for SQL injection and REST API abuse.
Threat summary
On July 21, 2026, multiple sources reported in-the-wild exploitation of a vulnerability chain in WordPress Core known as “wp2shell”.
Researchers link activity to at least thirteen IP addresses across several countries, with behavior progressing from targeted probing to broad Internet-wide scanning. Reported exploitation includes deployment of webshells, malicious plugin uploads, and exfiltration of hashed credentials.
The chain involves CVE-2026-63030 and CVE-2026-60137, two flaws fixed on July 17, 2026, and affecting WordPress Core:
-
6.8.x before 6.8.6
-
6.9.x before 6.9.5
-
7.0.x before 7.0.2
Public proof-of-concept (PoC) exploit code appeared within hours of disclosure. By July 19, multiple repositories hosted working PoCs and automated scanners.
WordPress is a widely deployed content management system used for public-facing websites across sectors. WordPress Core is the central software that provides built-in features such as the REST Application Programming Interface and the internal query engine. It is present in every WordPress installation, and these features are directly exposed to the Internet whenever a site is publicly accessible.
CVE-2026-63030 (CVSS: 9.8)
CVE-2026-63030 is a logic error in the WordPress REST API batch endpoint that allows an unauthenticated batch request to bypass normal route validation and reach internal API handlers. The batch processor incorrectly trusts the structure of the incoming request and executes routes that normally require authentication. This routing exposure provides the entry point the wp2shell exploit chain uses to reach the linked SQL injection in WP_Query.
CVE-2026-60137 (CVSS: 5.9)
CVE-2026-60137 is an input-handling flaw in WordPress Core’s WP_Query system involving the `author__not_in` parameter. WP_Query builds SQL statements dynamically, and this parameter is inserted into those statements without proper sanitization.
If a plugin or theme passes untrusted input into `author__not_in`, that input is able to modify the SQL that WordPress sends to the database, creating a direct path for SQL injection in the affected versions and forming the database-level component of the wp2shell exploit chain.
The exploit chain targets the REST API batch endpoint and the WP_Query `author__not_in` parameter. The PoC demonstrates that a single anonymous Hypertext Transfer Protocol request reaches the vulnerable endpoint and triggers code execution on WordPress 6.9 and 7.0 installations. It does not require plugins or special configuration and works on default installations.
Observed exploitation includes SQL injection payloads, webshell deployment, malicious plugin uploads, and exfiltration of hashed credentials.
Insights & mitigations
Unpatched instances could lead to full compromise of WordPress instances, persistent webshell access, unauthorized administrator account creation, theft of database contents, and use of compromised servers as pivot points.
WordPress Core is present in every installation and its Internet-exposed features, such as the REST API and WP_Query, are reachable on all public-facing sites.
Core vulnerabilities have repeatedly led to rapid, widespread exploitation. For example, the 2017 REST API privilege-escalation flaw (CVE-2017-1001000) resulted in mass defacement of hundreds of thousands of sites within days. wp2shell is following the same pattern, with exploitation shifting from targeted probing to broad scanning shortly after disclosure.
Affected organizations are advised to:
- Update WordPress Core to versions 7.0.2, 6.9.5, and 6.8.6 and verify automatic updates completed successfully.
- Review logs for REST API batch endpoint access, SQL injection payloads, unexpected plugin uploads, and unauthorized administrator account creation.
- Where feasible, restrict exposure of the batch endpoint at the web server or reverse proxy.
- Hunt for unexpected PHP files in content and cache directories and regenerate credentials and authentication salts.
- Strengthen monitoring for SQL injection attempts and anomalous REST API activity, and consider additional mitigations such as least-privilege database access, disabling unused REST API routes, and deploying a WAF tuned for these behaviors.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
.jpg)