Critical WP2Shell Flaws Unleash Massive Unauthenticated Attacks on WordPress Ecosystem

DNI SUMMARY — KEY POINTS

• The WP2Shell vulnerability chain allows unauthenticated remote code execution on default WordPress installations by exploiting two separate but chainable security flaws.
• Security researchers identified the critical CVE-2026-63030 and CVE-2026-60137 bugs, which enable attackers to gain complete server control without any valid user credentials.
• Major cybersecurity firms confirmed active exploitation in the wild, with various groups utilizing public proof-of-concept code to deploy persistent webshells across websites.
• WordPress responded to the unprecedented threat by issuing emergency security patches and initiating forced automatic updates for millions of affected global installations.
• Industry experts warn that while initial patching is underway, site administrators must conduct thorough security audits to detect potential unauthorized accounts or backdoors.

A catastrophic security failure has emerged within the global WordPress ecosystem, threatening millions of websites with total administrative compromise through the newly discovered WP2Shell exploit chain. This vulnerability, which leverages two distinct flaws tracked as CVE-2026-63030 and CVE-2026-60137, permits remote code execution without requiring any prior authentication. By manipulating the core batch-processing functionality of the platform, attackers can effectively bypass standard security layers. This development has triggered an industry-wide scramble as both security vendors and site owners race to mitigate the risk of widespread, automated server takeovers.

Mechanism of the Exploit

The core of the issue resides within the REST API batch endpoint, which was intended to streamline multiple requests into a single operation. When chained with an SQL injection vulnerability in the platform's query class, this logic flaw creates a direct path for command execution on the underlying server. Attackers have successfully weaponized this interaction to plant malicious webshells, allowing them to gain persistent access, exfiltrate sensitive data, or establish unauthorized administrator accounts. The ease with which this exploit can be triggered against default configurations makes it an exceptionally dangerous threat to the entire digital infrastructure.

Evidence of active exploitation surfaced shortly after the vulnerability details became public, with various cybercriminal groups launching high-volume scanning campaigns. SearchLight Cyber researchers were among the first to sound the alarm, confirming that the attack requires no preconditions or specific plugins to function. Telemetry data from several security organizations shows that malicious actors are utilizing globally distributed IP addresses to identify and compromise vulnerable targets. This rapid weaponization, facilitated by accessible proof-of-concept code, has significantly lowered the technical barrier for attackers to disrupt modern web operations.

Emergency Patching and Response

While the scale of the threat is vast, the WordPress development team acted with unusual urgency to address the underlying code flaws. Version updates 6.9.5 and 7.0.2 were released on July 17, 2026, specifically to neutralize the exploit chain. To ensure rapid adoption, the organization enabled forced automatic updates for all supported installations, a measure rarely taken unless the risk is deemed existential to the ecosystem. Despite these automated efforts, security analysts emphasize that manually verifying site integrity remains a critical necessity for any administrator concerned about potential post-exploitation activity.

Post-exploitation reports highlight a range of sophisticated malicious behaviors beyond the initial breach, including the injection of persistent backdoors and the harvesting of user credentials. In many observed cases, attackers have specifically targeted the /wp-content/cache/ directory to store their webshells, often using randomized filenames to evade detection. Furthermore, the creation of fraudulent administrator accounts has been identified as a standard tactic for maintaining long-term control. Security firms continue to monitor these developments closely, though they have yet to confirm involvement by state-sponsored advanced persistent threat groups at this stage.

Post Exploitation and Persistence

The broader cybersecurity community has expressed concern regarding the prevalence of similar API-based vulnerabilities that remain undetected in widely used software. By leveraging AI-assisted analysis, researchers have found that reproducing these complex exploit chains has become increasingly trivial. This trend suggests that developers must prioritize hardening the internal logic of core services rather than relying solely on surface-level protection. The WP2Shell incident stands as a stark reminder that even a default, unconfigured installation is no longer immune to the advanced techniques now being deployed by opportunistic criminal networks.

As remediation efforts continue, experts suggest a comprehensive approach to securing exposed instances that might have been compromised before patches were applied. This involves performing a thorough audit of the user database for unauthorized accounts and inspecting the file system for hidden entries or modified scripts. Security tools like the one provided by SOCRadar have become essential resources for site owners attempting to determine their exposure levels. Without such rigorous verification, administrators risk remaining vulnerable to backdoors planted well before the security patches were officially deployed to the public.

Future Implications for Security

Looking forward, the incident is expected to fundamentally change how critical security updates are managed within the open-source community. The effectiveness of forced updates in this specific case has been lauded, but it also raises questions about centralized control and site stability. Meanwhile, threat intelligence teams remain vigilant for any signs of secondary attacks, including potential data exfiltration or lateral movement within hosted environments. Until the last of the vulnerable legacy installations are secured, the threat to the global web infrastructure will likely persist, requiring constant monitoring from both developers and enterprise security staff.