WordPress Vulnerability Allows Unauthenticated Remote Code Execution and Full Website Compromise

Attackers have initiated active exploitation of two critical vulnerabilities within the WordPress content management system, which when combined, grant unauthenticated remote code execution (RCE) and the complete compromise of vulnerable websites. The security flaws, identified as CVE-2026-63030 and CVE-2026-60137, have been collectively dubbed "wp2shell." The widespread exploitation began shortly after public exploit code became available, indicating a rapid and significant threat to the global WordPress user base.

The timeline of this emerging threat suggests a swift escalation from discovery to active exploitation. By Saturday morning UTC, security researchers observed the initial stages of attack, primarily focusing on the exfiltration of hashed credentials. This was followed by the deployment of remote code execution capabilities as more technical details of the vulnerabilities were disseminated. This rapid progression underscores the urgent need for website administrators to apply necessary patches and security measures.

Deep Dive into the wp2shell Vulnerability Chain

The wp2shell exploit chain is a sophisticated two-part attack that leverages a combination of vulnerabilities to achieve a high level of system access. The initial entry point is a route confusion bug within the REST API batch endpoint, identified as CVE-2026-60137. This flaw, present in WordPress versions from 6.8 onwards, allows attackers to bypass authentication mechanisms and invoke internal handlers without any required permission checks.

Ben Marr, a security engineer at Intruder, explained the mechanics of this initial breach: "CVE-2026-60137 is the entry point – a route confusion bug in the REST API batch endpoint that bypasses authentication, allowing an attacker to invoke internal handlers without any permission check." He further elaborated on the underlying cause: "This flaw arises from the improper sanitization of the ‘author__not_in’ parameter within ‘WP_Query’ when untrusted data is passed to it by a plugin or theme. This vulnerability allows crafted input to alter a database query, potentially leading to unauthorized access or manipulation of data." This means that even without logging in, an attacker can manipulate database queries through this specific parameter.

The second crucial vulnerability, CVE-2026-63030, is what enables the critical remote code execution. According to Cloudflare, this vulnerability allows for unauthenticated RCE, but with a specific condition: it is exploitable only when persistent object caching is not in use. However, the severity of the exploit chain means that even with this caveat, a substantial number of WordPress installations remain at risk. The RCE aspect of the vulnerability affects WordPress versions from 6.9 onwards, making it a threat to more recent and widely adopted installations.

The combination of these two vulnerabilities creates a potent exploit. Searchlight Cyber, utilizing advanced AI tools like OpenAI GPT 5.6 Sol, discovered that the exploit chain can be used to gain remote code execution on default WordPress installations. This discovery process reportedly took over 10 hours, highlighting the complexity and the potential for sophisticated actors to develop such exploits. The critical nature of these findings led to the withholding of specific technical details to prevent further immediate weaponization, though public exploit code has since emerged.

A significant concern highlighted by Searchlight Cyber is that "the attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins." This means that even websites with minimal customization and without third-party extensions are vulnerable, drastically increasing the potential attack surface.

Widespread Exploitation and Global Impact

The repercussions of the wp2shell vulnerabilities are already being felt across the globe. Jake Knott, principal security researcher at watchTowr, reported that "By the early hours of Saturday morning (UTC), successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public." Knott further emphasized the pervasive nature of the threat: "From our vantage point across a global client base, we are seeing widespread impact of this vulnerability across organizations of every size and every vertical."

Telemetry data from KEVIntel provides concrete evidence of this global exploitation. As of recent reports, 13 unique IP addresses from a diverse range of countries including Switzerland, Germany, the United Kingdom, Indonesia, Lithuania, the Netherlands, and Singapore have been linked to the exploitation of CVE-2026-63030. This geographical distribution indicates that attackers are not confined to any single region, posing a threat to websites worldwide.

Furthermore, data from Google-owned Wiz suggests a significant initial exposure rate. At the time these CVEs were published, Wiz observed that "60% of organizations using WordPress initially had at least one vulnerable instance," and a concerning "25% were exposing a vulnerable server to the Internet." While these figures have reportedly decreased as organizations implement fixes, the initial high percentage highlights the vast number of websites that were potentially compromised in the early stages of the attack.

WatchTowr has also documented extensive exploitation attempts. Following the release of public exploit code, attackers began an indiscriminate spraying of the internet. WatchTowr’s honeypots registered "tens of thousands of exploitation attempts," a clear indicator of automated scanning and active exploitation campaigns.

Observed Post-Exploitation Activities

The impact of the wp2shell vulnerabilities extends beyond initial compromise, with attackers engaging in various post-exploitation activities. Wiz researchers Shahar Dorfman and Gili Tikochinski have detailed some of these observed behaviors:

• Creation of Backdoor Administrator Accounts: In numerous instances, attackers have created over 100 backdoor administrator accounts. This allows them to maintain persistent access to compromised systems, even if the initial exploit vector is patched.
• Deployment of Malicious Plugins: These newly created administrator accounts are then used to deploy fake WordPress plugins. These plugins often serve as a mechanism to gain further code execution or to download additional malicious tools for deeper system compromise.
• Installation of Remote Access Trojans (RATs): In at least one documented case, a threat actor was observed repeatedly attempting to install Overlord RAT, a Golang-based remote access trojan. RATs provide attackers with extensive control over the compromised machine, enabling them to steal data, monitor user activity, and use the system for further malicious purposes.
• Web Shell Deployment: A sophisticated 150 KB web shell, disguised as a legitimate WordPress security plugin named CMSmap, has also been observed. This web shell functions as a "full-featured attack platform," offering capabilities such as file management, direct database access, port scanning, batch code injection, and multiple privilege escalation modules, including those exploiting MySQL User-Defined Functions (UDFs).

Wiz researchers also noted "high-volume scanning activity without subsequent post-exploitation, suggesting opportunistic mass-scanning campaigns seeking to identify vulnerable targets alongside legitimate security scanning activity." While lateral movement and data exfiltration have not been definitively identified in all cases, investigations are ongoing.

Broader Implications and Expert Reactions

The wp2shell vulnerabilities represent a significant threat to the digital ecosystem, given WordPress’s dominant market share. With an estimated 40% of the internet powered by WordPress, the potential for widespread disruption and data breaches is immense.

The use of advanced AI in discovering these vulnerabilities, as reported by Searchlight Cyber, also raises broader questions about the evolving landscape of cybersecurity. The ability for AI tools to rapidly analyze code and identify complex exploit chains could accelerate both offensive and defensive capabilities in the digital realm.

The rapid dissemination of exploit code and the subsequent active exploitation underscore a recurring challenge in cybersecurity: the race between vulnerability disclosure and patch deployment. While WordPress developers likely strive to address security issues promptly, the decentralized nature of website ownership means that patching can be a slow and uneven process.

Ben Marr of Intruder highlighted the ease of exploitation for these specific vulnerabilities: "This exploit utilizes a two-part vulnerability chain to achieve unauthenticated SQL injection on a stock WordPress installation with a single HTTP request." This simplicity in execution lowers the barrier to entry for malicious actors, making the threat even more potent.

Recommendations for Mitigation and Defense

In light of the active exploitation and the severity of the wp2shell vulnerabilities, website administrators are strongly advised to take immediate action. The primary recommendation is to update WordPress to the latest version, which includes patches for CVE-2026-63030 and CVE-2026-60137.

Beyond patching, several other security best practices are crucial:

• Regular Security Audits: Conduct thorough security audits of WordPress instances to identify any new administrator accounts, suspicious plugins, or unusual files that may have been introduced by attackers. This is recommended even for sites that have been patched, as a precautionary measure.
• Monitoring for Suspicious Activity: Implement robust monitoring systems to detect unusual login attempts, file modifications, and network traffic patterns.
• Enabling Persistent Object Caching: For sites running versions affected by CVE-2026-63030, ensuring that persistent object caching is enabled can provide an additional layer of defense against RCE.
• Web Application Firewalls (WAFs): Deploying and configuring a Web Application Firewall can help block malicious requests at the network perimeter, preventing exploitation attempts before they reach the WordPress application.
• Principle of Least Privilege: Ensure that all user accounts, especially administrator accounts, are configured with the minimum necessary privileges.
• Regular Backups: Maintain regular, secure, and offsite backups of website data and configurations. This will allow for a swift recovery in the event of a successful compromise.

The wp2shell vulnerabilities serve as a stark reminder of the ongoing threats facing websites globally. Vigilance, prompt patching, and adherence to robust security practices are essential for protecting digital assets in an increasingly complex threat landscape. The rapid response from the cybersecurity community and the proactive efforts of organizations to address these vulnerabilities are critical in mitigating the widespread impact of this significant security incident.