WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning
A public exploit, dubbed ‘wp2shell,’ is being aggressively used to target vulnerable WordPress installations, leading to widespread scanning and exploitation. Attackers are leveraging two vulnerabilities – CVE-2026-63030 and CVE-2026-60137 – to achieve unauthenticated remote code execution, resulting in the creation of numerous backdoor accounts and attempts to deploy malicious tools like Overlord RAT. Organizations are urged to actively monitor for suspicious activity.
A public exploit, known as ‘wp2shell,’ is rapidly spreading across vulnerable WordPress installations, causing significant disruption and potential compromise. The exploit chain combines two critical vulnerabilities – CVE-2026-63030 and CVE-2026-60137 – to enable unauthenticated remote code execution. Initial reports indicate that successful exploitation began early Saturday morning, with attackers utilizing public exploit code to exfiltrate hashed credentials and subsequently gain remote code execution.
Telemetry data from KEVIntel shows that a diverse range of IP addresses from countries including Switzerland, Germany, the U.K., Indonesia, Lithuania, the Netherlands, and Singapore have been linked to exploiting CVE-2026-63030. The exploit chain, discovered by Searchlight Cyber using OpenAI GPT 5.6 Sol in over 10 hours, allows unauthenticated attackers to gain remote code execution on default WordPress installations in any WordPress version released since December 2025.
Intruder’s Ben Marr explained that CVE-2026-60137, a SQL injection vulnerability present from version 6.8 onwards, serves as the initial entry point – a route confusion bug in the REST API batch endpoint that bypasses authentication. This allows an attacker to invoke internal handlers without any permission check. The vulnerability arises from improper sanitization of the ‘author__not_in’ parameter within ‘WP_Query’ when untrusted data is passed to it by a plugin or theme.
Cloudflare’s data suggests that 60% of organizations using WordPress initially had at least one vulnerable instance at the time these CVEs were published, with 25% exposing a vulnerable server to the internet. Wiz observed post-exploitation activities including uploading malicious plugins, enumerating users and harvesting admin usernames and email addresses, performing local file inclusion (LFI) attacks to target database credentials and authentication keys, accessing the admin panel and successfully authenticating, and uploading a 150 KB web shell disguised as a legitimate WordPress security plugin called CMSmap.
CMSmap acts as a “full-featured attack platform” supporting file management, database access, port scanning, batch code injection, and multiple privilege escalation modules, including MySQL UDF exploitation. WatchTower reported that attackers have begun to spray the Internet in an indiscriminate fashion following the release of a public exploit, with its honeypots registering “tens of thousands of exploitation attempts.” More than 100 backdoor administrator accounts have been created following exploitation, allowing attackers to deploy fake WordPress plugins to gain code execution or download secondary tools to further compromise the system. In one instance, a threat actor repeatedly attempted to install Overlord RAT, a Golang-based remote access trojan.
Defenders are strongly advised to meticulously inspect their WordPress instances for new administrator accounts, malicious plugins, or any other suspicious files, even if they have been patched, to completely eliminate the threat.