Cybercriminals are currently capitalizing on the “wp2shell” critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137), which significantly impacts WordPress Core.
This exploitation allows for the deployment of persistent webshells as well as the installation of malicious plugins on the affected servers.
This exploit chain, deemed critical, manipulates the batch-processing functionality of the WordPress REST API. Consequently, it enables remote attackers to execute arbitrary code on vulnerable installations without necessitating any form of authentication.
While detailed technical specifications remain undisclosed, proof-of-concept exploits began surfacing shortly after the cyber risk management firm SearchLight Cyber unveiled the wp2shell security vulnerability over the weekend.
Following the identification of this vulnerability, WordPress promptly addressed it in versions 7.0.2, 6.9.5, and 6.8.6, which forced automatic security updates for all supported installations, thereby confirming active exploitation.
Cloud security company Wiz has provided insights into observed attacks utilizing wp2shell, noting that threat actors engaged in several key activities:
- Conducting mass scans for vulnerable WordPress installations, primarily through security scanning endeavours.
- Exploiting the WordPress plugin upload functionality to introduce malicious add-ons.
- Installing PHP webshells that range from rudimentary one-liner backdoors to sophisticated, obfuscated shells masquerading as plugins (CMSmap).
- Utilizing the WordPress REST API to extract administrator usernames and email addresses.
- Employing local file inclusion tactics targeting wp-config via admin-ajax.php to obtain critical database credentials and authentication keys.
- Deploying a malicious plugin that exposes a REST API endpoint for remote command execution.
- Gaining unauthorized access to WordPress administration panels.
While Wiz indicated that lateral movement or data exfiltration had not been encountered, they continue to vigilantly monitor the ongoing threat activity.
A separate analysis from Johannes B. Ullrich, Dean of Research at Sans Technology Institute, delineates two-stage attacks initiating with SQL injection to confirm vulnerabilities, followed by delivering a PHP webshell to the server.
This webshell, established in the /wp-content/cache/ directory, utilized a randomized filename that also served as a password. Access was granted via a variable in a URL request; otherwise, the page returned a deceptive 404 error.
The malicious code that Ullrich divulged checked for the presence of various PHP functions—system(), passthru(), exec(), shell_exec(), popen(), or the backtick operator—with the intent to execute commands.
Moreover, Ullrich noted that certain attacks also entailed the creation of fraudulent administrator accounts. Consequently, he advises inspecting the /cache/ directory for new entries and scrutinizing for unauthorized administrator accounts.
WordPress security company Defiant has disseminated an “post-exploitation” report, indicating that the initial reconnaissance for exploitation was detected at 23:29 UTC on July 17, swiftly followed by a SQL injection attempt just 13 minutes thereafter.
Administrators of WordPress sites are urged to promptly update to the remediated versions, meticulously review logs for wp2shell-related requests, inspect installed plugins, and check for illicit PHP file additions or the creation of unauthorized admin accounts.
Researcher Yutaka Sejiyama from Macnica has developed a dashboard to facilitate live tracking of the patch rate, which currently reflects an 81.6% patch rate based on a sample of 124,580 assessed websites.
In a further commentary, SearchLight Cyber researcher Adam Kues has published a detailed report exploring the process of unveiling wp2shell and constructing a viable exploit chain, which incorporated the use of AI tools.
Source link: Bleepingcomputer.com.
