Hackers are actively exploiting two critical vulnerabilities in WordPress Core (CVE-2026-63030 and CVE-2026-60137) to deploy webshells, install malicious plugins, and execute code on vulnerable servers.
According to threat intelligence and cyber risk management company SearchLight Cyber, proof-of-concept exploits emerged over the weekend shortly after they disclosed the `wp2shell` security issue. Active exploitation was quickly confirmed, prompting WordPress to release patches for versions 7.0.2, 6.9.5, and 6.8.6, which force automatic security updates for supported installations.
Cloud security company Wiz has shared technical details about observed attacks leveraging `wp2shell`, revealing that threat actors are performing a range of malicious activities, including:
* Mass-scanning for vulnerable WordPress installations
* Abuse of WordPress plugin upload functionality to install malicious add-ons
* Installation of PHP webshells ranging from simple one-liner backdoors to feature-rich, obfuscated shells disguised as plugins (CMSmap)
* Querying the WordPress REST API to collect administrator usernames and email addresses
* Local file inclusion attempts targeting `wp-config` through `admin-ajax.php` to retrieve database credentials and authentication keys
* Deployment of a malicious plugin exposing a REST API endpoint for remote command execution
Wiz notes that it has not observed lateral movement or data exfiltration but continues to monitor the threat activity.
A separate report from Johannes B. Ullrich, Dean of Research at Sans Technology Institute, describes two-stage attacks that start with probing SQL injection to confirm the vulnerability before delivering a PHP webshell to the server. The webshell was created under the `/wp-content/cache/` directory with a randomized filename that was also used as a password to access it via variable in an URL request; otherwise, the page returned a fake 404 page.
The webshell code checked the availability of several PHP functions – `system()`, `passthru()`, `exec()`, `shell_exec()`, `popen()`, or the backtick operator, in an attempt to execute commands. Ullrich also notes that some attacks involve creating rogue administrator accounts.
As such, he recommends checking the `/cache/` directory and looking for newly created users.
WordPress security firm Defiant has published a guide on how to prevent similar attacks, which includes:
* Keeping WordPress up-to-date with the latest security patches
* Using strong passwords and two-factor authentication
* Monitoring server logs for suspicious activity
* Regularly scanning for malware and vulnerabilities
It is essential to take these precautions seriously, as the `wp2shell` vulnerability suite has already been exploited in the wild.
**Recommendations:**
* Update WordPress to the latest version (7.0.3 or higher)
* Use a reputable security plugin to monitor for suspicious activity
* Regularly back up your website data to prevent loss in case of an attack
By taking these steps, you can significantly reduce the risk of falling victim to this critical vulnerability.
Source: Original article