WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites.

The two security flaws, tracked as CVE-2026-63030 and CVE-2026-60137, have been codenamed wp2shell.

“By the early hours of Saturday morning (UTC), successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public,” Jake Knott, principal security researcher at watchTowr, told The Hacker News in a statement.

“From our vantage point across a global client base, we are seeing widespread impact of this vulnerability across organizations of every size and every vertical.”

Telemetry data captured by KEVIntel shows that 13 unique IP addresses from Switzerland, Germany, the U.K., Indonesia, Lithuania, the Netherlands, and Singapore have been linked to the exploitation of CVE-2026-63030.

The exploit chain, discovered by Searchlight Cyber using OpenAI GPT 5.6 Sol in over 10 hours, essentially allows unauthenticated attackers to gain remote code execution on default WordPress installations in any WordPress version released since December 2025. Technical details have been withheld in light of the severity of the issue.

“The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins,” Searchlight Cyber said.

According to Cloudflare, CVE-2026-63030 enables unauthenticated remote code execution (RCE) only when persistent object cache is not in use. While the SQL injection vulnerability (CVE-2026-60137) is present from version 6.8 onwards, the RCE affects versions from 6.9.

“This exploit utilizes a two-part vulnerability chain to achieve unauthenticated SQL injection on a stock WordPress installation with a single HTTP request,” Ben Marr, security engineer at Intruder, explained. “CVE-2026-60137 is the entry point – a route confusion bug in the REST API batch endpoint that bypasses authentication, allowing an attacker to invoke internal handlers without any permission check.”

“This flaw arises from the improper sanitization of the ‘author__not_in’ parameter within ‘WP_Query’ when untrusted data is passed to it by a plugin or theme. This vulnerability allows crafted input to alter a database query, potentially leading to unauthorized access or manipulation of data.”

Data from Google-owned Wiz suggests that 60% of organizations using WordPress initially had at least one vulnerable instance at the time these CVEs were published, and 25% were exposing a vulnerable server to the Internet. The figures have since dropped as organizations continue to apply the fixes.

The cloud security subsidiary has observed the following post-exploitation activities following the abuse of the two flaws –

• Uploading a malicious plugin
• Enumerating users and harvesting admin usernames and email addresses
• Performing local file inclusion (LFI) attacks to target database credentials and authentication keys for exfiltration
• Accessing the admin panel and successfully authenticating themselves
• Uploading a bare-bones PHP web shell that facilitates remote code execution

“We’ve also observed high-volume scanning activity without subsequent post-exploitation, suggesting opportunistic mass-scanning campaigns seeking to identify vulnerable targets alongside legitimate security scanning activity,” Wiz researchers Shahar Dorfman and Gili Tikochinski said. “We have yet to identify lateral movement or data exfiltration, but we continue to monitor and investigate.”