Critical wp2shell Vulnerability Chain Exploited in WordPress for Unauthenticated Remote Code Execution and Webshell Deployment

A critical vulnerability chain in WordPress Core, known as wp2shell, is being actively exploited to achieve unauthenticated remote code execution and install persistent webshells. The issue has been addressed in WordPress 7.0.2, 6.9.5, and 6.8.6, and site owners are strongly advised to apply updates without delay while checking exposed servers for signs of compromise.

Administrators running recent versions of WordPress Core currently face a direct threat. The wp2shell chain allows attackers to take full control of the server without any credentials and is already being used in real-world attacks to deploy webshells and malicious plugins. The risk primarily affects installations on the 7.0.x branch before 7.0.2 and the 6.9.x branch before 6.9.5, with a fixed release also available for the 6.8 branch at version 6.8.6.

Technical Details of the Exploit Chain

The core of the attack lies in the WordPress REST API, specifically its batch processing mechanism. Attackers combine two vulnerabilities, CVE-2026-63030 and CVE-2026-60137, to move from seemingly legitimate requests to full unauthenticated remote code execution. The first flaw involves a path confusion issue in the batch processing endpoint, while the second exploits an SQL injection in WP_Query tied to the author__not_in parameter. Together these issues allow escalation from manipulated queries to arbitrary code execution on the server.

Observed indicators align with automated attack campaigns. These include widespread scanning of WordPress instances, queries to the REST API to enumerate potential administrators, and collection of usernames and email addresses. In parallel, attackers attempt local file inclusion targeting wp-config.php to extract database credentials and authentication keys.

Persistence and Post-Exploitation Activity

Once access is gained, the primary goal is establishing persistence. Attackers have been observed creating PHP webshells in paths such as wp-content/cache using random filenames. These webshells return a fake 404 response unless the expected parameter is supplied. In some cases, intruders also create fraudulent administrator accounts or install plugins that facilitate remote control.

Recommended Mitigation Steps

The immediate priority is updating to WordPress 7.0.2, 6.9.5, or 6.8.6 depending on the installed branch and verifying that automatic security updates have been applied. After patching, administrators should review access and application logs for anomalous requests to the REST API and its batch endpoints, inspect installed plugins, and remove any recent unauthorized user accounts.

It is also recommended to search for newly created PHP files in unusual locations inside wp-content, audit users with elevated privileges, and delete any unauthorized accounts. If there are indications that wp-config.php was accessed, database credentials, authentication keys, and admin panel passwords must be rotated. In confirmed compromise scenarios, the response should include containment, clean reinstallation from a trusted backup, and full rotation of all secrets to eliminate persistence.