A Critical Vulnerability Suite Exploited to Install Webshells on Vulnerable WordPress Sites
Hackers have been actively exploiting a critical vulnerability suite, dubbed “wp2shell,” affecting WordPress Core. The exploit chain takes advantage of two vulnerabilities, identified as CVE-2026-63030 and CVE-2026-60137, which allow remote attackers to execute code on vulnerable installations without authentication.
The issue stems from the abuse of the WordPress REST API’s batch-processing feature. This allows hackers to deploy persistent webshells and install malicious plugins on affected servers. Although the technical details of the vulnerability were not publicly disclosed, proof-of-concept exploits emerged over the weekend after threat intelligence company SearchLight Cyber announced the security issue.
WordPress addressed the problem in versions 7.0.2, 6.9.5, and 6.8.6, forcing automatic security updates for supported installations. However, many sites remain vulnerable as attackers continue to exploit the weakness. Cloud security firm Wiz has shared details on observed attacks, which involve mass-scanning for vulnerable WordPress installations, abusing plugin upload functionality, installing PHP webshells, querying the REST API, and attempting local file inclusion.
Wiz has not observed any lateral movement or data exfiltration but continues to monitor the threat activity. Researchers at Sans Technology Institute have also documented two-stage attacks that start with probing SQL injection before delivering a PHP webshell to the server. The webshell is created under the /wp-content/cache/ directory and uses a randomized filename as a password.
The exploitation of wp2shell highlights the importance of timely security updates and regular monitoring of system logs. Administrators of WordPress sites should immediately update to the patched versions, review logs for wp2shell-related requests, inspect installed plugins, and check for rogue PHP file additions or newly created admin accounts.
As researchers continue to monitor the situation, it’s essential for site owners to stay vigilant and take proactive measures to secure their installations. With 81.6% of a sample of 124,580 websites still unpatched, the risk of exploitation remains high. By taking these steps, administrators can reduce the likelihood of falling victim to this critical vulnerability suite.
In the wake of this attack, it’s clear that security teams need to stay proactive and vigilant in protecting their systems from emerging threats. Regularly testing and updating systems can help prevent these types of attacks from occurring in the first place. As we continue to navigate the ever-evolving threat landscape, staying informed and taking proactive measures will be crucial for ensuring the security of our online presence.
Source: Bleeping Computer — 2026-07-21