wp2shell: Critical WordPress RCE Flaws Fuel Mass Exploitation

Attackers are actively exploiting two critical vulnerabilities in WordPress—tracked as CVE-2026-63030 and CVE-2026-60137 and collectively codenamed "wp2shell"—to achieve unauthenticated remote code execution (RCE) and full compromise of vulnerable websites. According to Jake Knott, principal security researcher at watchTowr, mass exploitation was underway by early Saturday morning (UTC), with attackers initially using public exploit code to exfiltrate hashed credentials before escalating to RCE as additional technical details became public. "From our vantage point across a global client base, we are seeing widespread impact of this vulnerability across organizations of every size and every vertical," Knott told The Hacker News. Telemetry from KEVIntel links 13 unique IP addresses across Switzerland, Germany, the U.K., Indonesia, Lithuania, the Netherlands, and Singapore to the exploitation campaign, with activity expanding from WordPress-specific sensors to broad internet scanning that mirrors publicly available proof-of-concept exploits. Operators worried about credential exposure can verify whether their accounts appear in known collections using an email breach checker and test password strength with a password checker.

The exploit chain was discovered by Searchlight Cyber using OpenAI GPT 5.6 Sol in over ten hours of analysis, and essentially grants unauthenticated attackers full RCE on default WordPress installations released since December 2025. Ryan Dewhurst, founder and CEO of KEVIntel, noted that attackers deployed multiple SQL injection techniques—including blind, UNION-based, and Boolean-based payloads—and warned that AI-assisted analysis made reproducing the vulnerability and crafting working PoCs "trivial," dramatically lowering the technical barrier for weaponization. "The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins," Searchlight Cyber confirmed. Ben Marr, security engineer at Intruder, explained the mechanics: CVE-2026-60137 is the entry point—a route confusion flaw in the REST API batch endpoint that bypasses authentication and invokes internal handlers without permission checks—while CVE-2026-63030 chains this access to achieve unauthenticated SQL injection via improper sanitization of the 'author__not_in' parameter in WP_Query.

According to Cloudflare, CVE-2026-63030 enables unauthenticated RCE only when persistent object cache is not in use. The SQL injection vulnerability (CVE-2026-60137) is present from WordPress 6.8 onward, while the RCE path affects versions from 6.9 forward. Cloudflare has deployed mitigations at the network edge, but defenders are urged to audit exposed WordPress instances, inspect for indicators of compromise, and ensure HTTP services are not inadvertently exposed beyond intended ports—something a port scanner can quickly verify. Technical details remain intentionally limited given the severity, but the combination of zero preconditions, one-shot HTTP exploitation, and AI-accelerated PoC development places wp2shell squarely in the category of vulnerabilities requiring immediate patching, virtual patching via WAF rules, or aggressive monitoring of authentication logs for anomalous REST API batch requests.