Skip to content
Braincap
← All articles

wp2shell: a critical WordPress flaw exploited to install webshells

Illustration of a webshell installed on a compromised WordPress site

A critical flaw in the WordPress core, dubbed wp2shell, is being actively exploited to install webshells and take over sites. The attack has no preconditions and works on a stock install with no plugins. Below are the facts and, at the end, what to do.

In brief

  • Affected: WordPress Core — versions 6.9.0–6.9.4 and 7.0.0–7.0.1.
  • Vulnerabilities: CVE-2026-63030 (a route-confusion flaw in the REST API batch processor) chained with CVE-2026-60137 (SQL injection).
  • Impact: unauthenticated remote code execution (pre-auth RCE) on a stock install, no plugins required.
  • Fix: 6.9.5 and 7.0.2, released on 17 July 2026, via automatic security updates.
  • Status: actively exploited in the wild, with public exploits available.

How it works, in brief

  • WordPress 6.9 introduced a batch REST API (/wp-json/batch/v1) that validates and executes sub-requests in separate loops.
  • CVE-2026-63030: when wp_parse_url() fails on a sub-request path, the error is pushed to the validation array but not the matches array — the two desynchronize, and subsequent requests are dispatched to the wrong handler.
  • Through that confusion, the attacker reaches an SQL injection in WP_Query (CVE-2026-60137) and, ultimately, the creation of an administrator account — without authenticating.

Exploited in the wild

  • 17 July 2026: the fixes shipped (6.9.5 / 7.0.2). Probing began the same evening; per the firm Defiant (Wordfence), at 23:29 UTC, followed by SQL injection attempts 13 minutes later.
  • 18–20 July 2026: in-the-wild exploitation is confirmed, with public exploits in circulation.
  • In observed attacks, actors mass-scan, upload malicious plugins, install PHP webshells (including obfuscated variants), extract admin credentials via REST API queries, and attempt local file inclusion against wp-config.php.
  • A Macnica researchers’ dashboard reported an 81.6% patch rate across 124,580 evaluated sites — meaning roughly one in five was still vulnerable.

Indicators of compromise

  • webshells in the /wp-content/cache/ directory, with randomized filenames;
  • newly created administrator accounts;
  • malicious plugins disguised as legitimate add-ons.

What to do now

  1. Update immediately to WordPress 6.9.5 or 7.0.2 (or confirm the automatic update was applied).
  2. Check the indicators above: unknown files in /wp-content/cache/, new administrators, unfamiliar plugins.
  3. If you find signs of compromise, treat the site as breached: isolate it, rotate passwords and keys, and restore from a clean backup taken before the incident.

Sources