WP2Shell Vulnerability Allows Hackers to Generate WordPress Admin Accounts and Deploy Web Shells Without Authentication

WP2Shell Vulnerability Poses Threat to WordPress Security

WP2Shell exploits two inherent vulnerabilities within WordPress Core, facilitating a perilous pathway for unauthorized requests to culminate in server-side code execution.

This precarious scenario allows an attacker to create an administrator account while concurrently installing a plugin-based web shell.

The analysis conducted by Seqrite on October 16 outlines the affected releases, notably refraining from asserting any indication of extensive active exploitation. These vulnerabilities were brought to light in July 2026.

The significance of addressing this exploit chain lies in its circumvention of the authentication process.

A public-facing site utilizing an at-risk release could fall victim before its administrator becomes aware of any anomalies in account activity or plugin installations.

Seqrite analysts meticulously documented the WP2Shell vulnerability, integrating CVE-2026-63030 and CVE-2026-60137, thus forging a pathway from an openly accessible REST API inquiry to potential code execution.

Their technical exposition on WP2Shell delineates the execution sequence and relevant host artifacts.

The CVE-2026-63030 specifically impacts the REST API batch controller located at/wp-json/batch/v1, which is designed to manage multiple API requests within a single submission.

According to Seqrite, the conflation of nested requests can obfuscate route management and inadvertently invoke functionalities that necessitate authentication.

While this flaw does not independently execute code, it establishes a conduit to the secondary vulnerability.

On the other hand, CVE-2026-60137 constitutes an SQL injection vulnerability within the posts endpoint. The publicly accessible author_exclude parameter correlates with author__not_in within WP_Query.

Unraveling the WP2Shell Attack

Seqrite contends that inadequately managed input can adversely influence the database query. When combined with the route vulnerability, it permits an unauthorized request to penetrate the susceptible query.

This ultimately paves the way for establishing a foothold at the administrator level and executing code remotely.

In layman’s terms, SQL injection manipulates input to affect a database query in unintended ways. Here, the first vulnerability facilitates an unauthorized request’s reach to the susceptible query, while the second exposes the database to exploitation.

The ramifications of this exploit chain stem from the interaction of these two deficiencies, rather than either flaw being labeled a standalone web shell.

Once code is operational on the server, an intruder may possess the means to effectuate further alterations beyond the confines of the WordPress interface.

The illustrated procedural steps hold significant relevance for cybersecurity defenders. The exploit chain can surreptitiously establish an administrator account, create a ZIP archive in uploads, extract PHP files, and transfer a plugin directory into wp-content/plugins.

The plugin functions as a web shell, an interface through which server commands may be executed. Cybersecurity News has previously reported on a distinct WordPress account creation vulnerability, along with recent investigations into the Comment2Shell vulnerability, both of which unveiled similar perils associated with accounts or web shells.

Seqrite elucidates the process of temporary write checks within wp-content, followed by the staging of archives in wp-content/uploads/2026/10/ and subsequent extraction within wp-content/upgrade/.

Analysis of Sample Archive

The analyzed sample archive is delineated aswp2shell_4e9b3641.zip; the extracted files and plugin directories adhere to a wp2shell_ naming convention.

The report indicates that httpd.exe may execute file writes, as would be the case in normal plugin operations.

However, the mere presence of this process name does not constitute evidence of compromise. Far more telling indicators include the WP2Shell file names, emergence of new PHP files, and the existence of unexpected administrative accounts.

A prior incident involving a compromised WordPress plugin supply chain also incorporated a web shell, albeit utilizing a divergent delivery mechanism.

The report specifies that WordPress versions 6.9.0–6.9.4 and 7.0.0–7.0.1 are vulnerable to the complete exploit chain. Notably, versions 6.8.0–6.8.5 are impacted solely by CVE-2026-60137.

In contrast, versions 6.8.6, 6.9.5, and 7.0.2 have been patched for vulnerabilities. To mitigate risk, it is advised to upgrade to the appropriate patched release or a more recent supported version while ensuring the update has been completed successfully.

Limiting unauthenticated access to sensitive REST API functionalities may temporarily mitigate exposure; however, this is not a substitute for necessary patching.

Subsequent to the update, it is prudent to scrutinize for unknown administrator accounts, inspect plugin and cache directories for additional or altered PHP files, and audit logs for irregular batch-endpoint inquiries.

Be on the lookout for temp-write-test-* files, wp2shell_*.zip archives, and wp2shell_ plugin directories.

If identified, safeguard the evidence, deactivate dubious plugins, reset compromised credentials, and examine for persistence. Mere possession of a patched version number does not assure the rectification of any previous compromise.

Indicators of Compromise (IoCs):

Source link: Cybersecuritynews.com.