Hackers are actively exploiting a critical WordPress vulnerability chain known as wp2shell, tracked as CVE-2026-63030 and CVE-2026-60137, to install persistent webshells and rogue plugins on vulnerable servers. The flaws affect WordPress Core and abuse the REST API’s batch-processing feature to allow unauthenticated remote code execution.
Proof-of-concept exploits surfaced over the weekend, shortly after threat intelligence firm SearchLight Cyber disclosed the issue. Exploitation was confirmed almost immediately, prompting WordPress to force automatic security updates to versions 7.0.2, 6.9.5, and 6.8.6 for supported installations.
Observed Attack Activity
Cloud security firm Wiz reported that attackers have been mass-scanning for vulnerable installations, abusing plugin upload functionality, and deploying PHP webshells ranging from simple one-liner backdoors to obfuscated shells disguised as a plugin called CMSmap. Attackers have also queried the REST API to collect administrator usernames and emails, attempted local file inclusion against wp-config via admin-ajax.php to steal database credentials and authentication keys, and installed malicious plugins exposing REST endpoints for remote command execution. Wiz confirmed successful access to WordPress admin panels but said it has not yet observed lateral movement or data exfiltration.
Separately, Johannes B. Ullrich of the SANS Technology Institute described two-stage attacks that begin with SQL injection probing to confirm the vulnerability before dropping a PHP webshell into the /wp-content/cache/ directory under a randomized filename. The filename doubles as a password passed via URL parameter; requests without it return a fake 404 page. The webshell checks for available PHP execution functions such as system(), passthru(), exec(), shell_exec(), popen(), or the backtick operator. Ullrich noted some attacks also create rogue administrator accounts.
WordPress security firm Defiant said the earliest exploitation-related probing was observed at 23:29 UTC on July 17, with a clear SQL injection attempt following just 13 minutes later. Dark Reading separately noted that attackers began widely chaining the two CVEs within three days of disclosure, targeting one of the largest attack surfaces on the internet.
Patch Status and Recommendations
A live tracking dashboard built by Macnica researcher Yutaka Sejiyama reports an 81.6 percent patch rate across a sample of 124,580 evaluated WordPress sites. SearchLight Cyber researcher Adam Kues has also published details on how the flaw was discovered and weaponized, noting the process involved the use of AI tools.
Administrators running WordPress should immediately update to the patched versions, review logs for wp2shell-related requests, inspect installed plugins, and check the /cache/ directory and user accounts for unauthorized additions.