https://isc.sans.edu/diary/WordPress+Exploitation+Underway+CVE202663030/33168
Hackers are actively exploiting a critical pair of vulnerabilities in WordPress Core, tracked as CVE-2026-63030 and CVE-2026-60137 and collectively dubbed wp2shell, to install persistent webshells and malicious plugins on unpatched servers. The exploit chain abuses the WordPress REST API’s batch-processing feature to achieve unauthenticated remote code execution, meaning attackers require no credentials to compromise a vulnerable installation. WordPress has addressed the issue in versions 7.0.2, 6.9.5, and 6.8.6, with automatic security updates pushed to supported installations, though as of recent tracking approximately 18 percent of a sample of over 124,000 websites remain unpatched. Proof-of-concept exploits began circulating over the weekend shortly after threat intelligence firm SearchLight Cyber disclosed the vulnerability, with active exploitation confirmed almost immediately after patches were released.
Wiz has documented the observed attack activity in detail, describing a campaign involving mass-scanning for vulnerable installations, abuse of the plugin upload functionality to install malicious add-ons, deployment of PHP webshells ranging from simple one-liner backdoors to feature-rich obfuscated shells disguised as legitimate plugins, and querying of the REST API to harvest administrator usernames and email addresses. Attackers have also been observed attempting local file inclusion via admin-ajax.php to retrieve database credentials and authentication keys from wp-config, deploying a malicious plugin that exposes a REST API endpoint for remote command execution, and in some cases gaining direct access to WordPress administration panels. Wiz states it has not yet observed lateral movement or data exfiltration but continues to monitor the situation.
Analysis shows a two-stage attack pattern beginning with SQL injection probing to confirm vulnerability before dropping a PHP webshell into the wp-content/cache/ directory under a randomised filename that also serves as a password. The webshell returns a fake 404 page to unauthenticated requests while providing command execution to those with the correct credential. Some attacks have additionally involved the creation of rogue administrator accounts. WordPress site administrators are urged to update immediately, review server logs for wp2shell-related requests, inspect installed plugins and PHP files for unauthorised additions, and audit user accounts for any newly created administrators.