WordPress Websites Under Siege: Exploitation of wp2shell Vulnerabilities Unleashes Remote Code Execution and Widespread Compromise

The digital landscape for WordPress website administrators has been thrown into a state of high alert as attackers have rapidly begun exploiting a critical vulnerability chain, codenamed wp2shell, allowing for unauthenticated remote code execution (RCE) and the complete compromise of vulnerable sites. This sophisticated attack vector targets two interconnected security flaws, identified as CVE-2026-63030 and CVE-2026-60137, which, when leveraged in tandem, provide attackers with an unprecedented level of access.

The wp2shell Exploit: A Two-Pronged Assault

The wp2shell exploit is a potent combination, meticulously crafted to bypass security measures and achieve deep system penetration. At its core, the attack relies on a route confusion bug within the WordPress REST API’s batch endpoint, a vulnerability cataloged as CVE-2026-60137. This flaw, present in WordPress versions from 6.8 onwards, allows attackers to circumvent authentication protocols with a single HTTP request, effectively bypassing permission checks and invoking internal handlers.

"This exploit utilizes a two-part vulnerability chain to achieve unauthenticated SQL injection on a stock WordPress installation with a single HTTP request," Ben Marr, a security engineer at Intruder, explained. "CVE-2026-60137 is the entry point – a route confusion bug in the REST API batch endpoint that bypasses authentication, allowing an attacker to invoke internal handlers without any permission check."

The critical aspect of this initial breach is the improper sanitization of the ‘author__not_in’ parameter within ‘WP_Query.’ When untrusted data is passed to this parameter, often facilitated by vulnerable plugins or themes, it can lead to a manipulation of database queries. This can result in unauthorized access to sensitive data or even direct manipulation of the database itself.

However, the true danger of wp2shell emerges when this SQL injection capability is combined with CVE-2026-63030. This second vulnerability, which impacts WordPress versions from 6.9 onwards, enables remote code execution, but crucially, only when persistent object caching is not actively in use. This condition is unfortunately common in many default WordPress installations, leaving a significant number of websites exposed.

"From our vantage point across a global client base, we are seeing widespread impact of this vulnerability across organizations of every size and every vertical," Jake Knott, principal security researcher at watchTowr, stated in an interview. "By the early hours of Saturday morning (UTC), successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public."

Timeline of Exploitation: Rapid Escalation

The speed at which the wp2shell vulnerabilities have been weaponized is a stark indicator of the current threat landscape. While the precise origin and full disclosure timeline remain under scrutiny, evidence suggests that exploitation began shortly after the vulnerabilities were understood and, critically, public exploit code became available.

WatchTowr’s observations indicate that by Saturday morning UTC, exploitation was already "well underway." This rapid adoption suggests that threat actors, potentially including those leveraging advanced AI tools for vulnerability discovery, were quick to integrate the exploit into their attack methodologies.

Searchlight Cyber, for instance, reported discovering the exploit chain using OpenAI GPT 5.6 Sol. Their analysis revealed that the exploit could achieve remote code execution on default WordPress installations across all versions released since December 2025. The discovery process itself reportedly took over 10 hours, highlighting the complexity and potential sophistication of the vulnerability chain.

The consequences of this rapid exploitation are far-reaching. Telemetry data captured by KEVIntel reveals that by the time of reporting, at least 13 unique IP addresses originating from Switzerland, Germany, the United Kingdom, Indonesia, Lithuania, the Netherlands, and Singapore had been linked to the exploitation of CVE-2026-63030. This geographically diverse spread underscores the global nature of the threat.

Widespread Impact and Initial Compromise Activities

The impact of wp2shell is not limited to a niche segment of the internet. Data compiled by Google-owned Wiz indicates a sobering reality: approximately 60% of organizations utilizing WordPress had at least one vulnerable instance at the time these CVEs were disclosed. Even more alarming, 25% of these organizations were actively exposing a vulnerable server to the public internet. While these figures have reportedly decreased as organizations rush to patch, the initial exposure was substantial.

The immediate aftermath of exploitation has revealed a disturbing pattern of post-compromise activities. Wiz researchers Shahar Dorfman and Gili Tikochinski noted in their analysis that the initial stages often involve opportunistic mass-scanning by threat actors seeking to identify vulnerable targets. This is often accompanied by legitimate security scanning activity, making it difficult to distinguish malicious intent.

"We’ve also observed high-volume scanning activity without subsequent post-exploitation, suggesting opportunistic mass-scanning campaigns seeking to identify vulnerable targets alongside legitimate security scanning activity," the Wiz researchers stated. "We have yet to identify lateral movement or data exfiltration, but we continue to monitor and investigate."

Beyond the initial scanning, more direct malicious activities have been observed. WatchTowr’s honeypots have registered "tens of thousands of exploitation attempts" as attackers indiscriminately scan the internet following the release of public exploit code.

A significant concern is the creation of backdoor administrator accounts. Reports indicate that over 100 such accounts have been established post-exploitation. These accounts serve as persistent backdoors, allowing attackers to deploy malicious WordPress plugins designed to gain further code execution or download secondary tools for deeper system compromise.

In at least one documented case, a threat actor was observed repeatedly attempting to install Overlord RAT, a Golang-based remote access trojan. This suggests a sophisticated and persistent approach by some attackers, aiming for full control and long-term access to compromised systems.

Furthermore, a 150 KB web shell has been identified, disguised as a legitimate WordPress security plugin named CMSmap. This malicious payload functions as a "full-featured attack platform," offering capabilities such as file management, direct database access, port scanning, batch code injection, and the deployment of multiple privilege escalation modules, including exploitation of MySQL User-Defined Functions (UDFs).

Technical Nuances and Mitigation Strategies

The wp2shell exploit chain’s effectiveness hinges on the interplay between its components and the configuration of the target WordPress installation. As Cloudflare elaborated, CVE-2026-63030’s RCE capability is contingent on the absence of persistent object caching. This detail highlights a crucial area for administrators to investigate.

"This exploit utilizes a two-part vulnerability chain to achieve unauthenticated SQL injection on a stock WordPress installation with a single HTTP request," Ben Marr, security engineer at Intruder, explained. "CVE-2026-60137 is the entry point – a route confusion bug in the REST API batch endpoint that bypasses authentication, allowing an attacker to invoke internal handlers without any permission check."

The vulnerability arises from the improper sanitization of the ‘author__not_in’ parameter within ‘WP_Query’ when untrusted data is passed to it by a plugin or theme. This vulnerability allows crafted input to alter a database query, potentially leading to unauthorized access or manipulation of data.

Given the severity and widespread nature of this threat, immediate and comprehensive mitigation strategies are paramount. Security experts are strongly advising WordPress administrators to take the following steps:

• Immediate Patching: The most critical step is to update all WordPress installations to the latest secure versions. This includes not only the core WordPress software but also all themes and plugins.
• Vulnerability Scanning: Conduct thorough scans of all WordPress instances to identify any signs of compromise. This should include checking for newly created administrator accounts, suspicious plugins, and unusual files within the WordPress directory.
• Object Cache Configuration: For installations that have not yet been patched or if patching is delayed, administrators should ensure that persistent object caching is enabled and correctly configured. This can act as a critical layer of defense against the RCE component of the wp2shell exploit.
• Review Administrator Accounts: Scrutinize all existing administrator accounts. Remove any accounts that are unfamiliar or appear suspicious. Enforce strong, unique passwords for all administrative access.
• Plugin and Theme Auditing: Regularly audit installed plugins and themes. Deactivate and remove any that are not essential, outdated, or from untrusted sources. The wp2shell exploit’s reliance on vulnerable plugins or themes makes this a vital step.
• Web Application Firewalls (WAFs): Implement and configure a robust Web Application Firewall. WAFs can help detect and block malicious traffic patterns associated with exploit attempts, including SQL injection and attempts to execute arbitrary code.
• Security Monitoring: Enhance security monitoring and logging. Regularly review server logs for unusual activity, such as multiple failed login attempts, unexpected file modifications, or outbound network connections to suspicious destinations.

Broader Implications and the Evolving Threat Landscape

The wp2shell incident serves as a stark reminder of the persistent and evolving threats facing websites built on popular content management systems like WordPress. The ease with which attackers can chain together vulnerabilities to achieve RCE, especially with the aid of advanced tools, underscores the need for continuous vigilance and proactive security measures.

The widespread use of WordPress, powering an estimated 40% of all websites on the internet, makes it a prime target for attackers. The potential for widespread disruption, data breaches, and financial loss is immense. This incident highlights a critical vulnerability in the digital supply chain, where a flaw in a widely adopted platform can have cascading effects across a vast ecosystem.

The role of AI in vulnerability discovery and exploitation, as suggested by Searchlight Cyber’s findings, is a significant development. As AI tools become more sophisticated, the speed and effectiveness of attack campaigns are likely to increase. This necessitates a corresponding evolution in defensive strategies, focusing on automated threat detection, rapid patching, and resilient security architectures.

"We’ve also observed high-volume scanning activity without subsequent post-exploitation, suggesting opportunistic mass-scanning campaigns seeking to identify vulnerable targets alongside legitimate security scanning activity," Wiz researchers Shahar Dorfman and Gili Tikochinski said. "We have yet to identify lateral movement or data exfiltration, but we continue to monitor and investigate."

The ongoing investigation into the full scope of post-exploitation activities is crucial. While initial reports have focused on code execution and backdoor creation, the potential for data exfiltration, ransomware deployment, or further lateral movement within compromised networks remains a significant concern. Security teams worldwide are working collaboratively to monitor the situation, share intelligence, and develop effective countermeasures.

For website owners and administrators, the wp2shell exploit is not just a technical issue; it’s a business imperative. The cost of a website compromise can extend far beyond immediate remediation efforts, impacting reputation, customer trust, and operational continuity. Therefore, investing in robust security practices, staying informed about emerging threats, and acting swiftly to address vulnerabilities are no longer optional but essential components of responsible website management in the digital age.