How the wp2shell Vulnerability Chain Enables RCE on Vanilla WordPress

Two critical vulnerabilities in WordPress — CVE-2026-63030 and CVE-2026-60137 — are being actively exploited by attackers in a chained exploit dubbed wp2shell. The chain allows an unauthenticated attacker to achieve remote code execution (RCE) on a stock WordPress installation without any plugins, leading to full site compromise. According to Wiz, at the time the CVEs were published, around 60% of organizations using WordPress had at least one vulnerable instance, and 25% of those were exposed to the internet. All administrators of WordPress versions 6.8 and higher must apply patches immediately and audit their systems for signs of compromise.

Technical anatomy of the wp2shell chain

The exploit combines two vulnerabilities into a single attack chain executed via one HTTP request:

• CVE-2026-60137 — the entry point. According to researchers, this is a route confusion bug in the batch endpoint of the WordPress REST API. It allows authentication bypass and invocation of internal handlers without any permission checks. The vulnerability has been present since WordPress 6.8.
• CVE-2026-63030 — a SQL injection caused by improper sanitization of the author__not_in parameter in WP_Query when unvalidated data is passed by a plugin or theme. This makes it possible to alter the SQL query and gain unauthorized access to data. The RCE component, according to Cloudflare data, affects versions starting with WordPress 6.9 and works only when a persistent object cache is not enabled.

The fundamental danger of wp2shell is that the attack requires no prerequisites: no installed plugins, no specific configuration, no credentials. A stock WordPress installation of any version released since December 2025 is vulnerable. Technical details of the exploit have not yet been disclosed due to the critical severity of the issue.

Notably, according to Searchlight Cyber, the exploit chain was discovered using the OpenAI GPT 5.6 Solin model over 10 hours of operation. This claim comes from a single source and has not been independently verified, but it nevertheless raises serious questions about the role of generative AI in the discovery of zero-day vulnerabilities.

Scale of exploitation and post‑exploitation activity

Multiple sources confirm active exploitation in the wild. According to KEVIntel telemetry, exploitation of CVE-2026-63030 is associated with 13 unique IP addresses from Switzerland, Germany, the United Kingdom, Indonesia, Lithuania, the Netherlands, and Singapore. Researchers at watchTowr report tens of thousands of exploitation attempts observed by their honeypots after a public exploit was released.

Wiz researchers observed the following attacker actions after successful exploitation:

• Uploading malicious plugins
• Enumerating users and collecting administrator names and email addresses
• Local File Inclusion (LFI) attacks to extract database credentials and authentication keys
• Accessing the admin panel with successful authentication
• Uploading a minimal PHP web shell to maintain remote code execution

In parallel, mass scanning without subsequent exploitation is being observed, indicating opportunistic campaigns to identify vulnerable targets alongside legitimate security scanning. At the time of publication, Wiz researchers had not observed lateral movement or data exfiltration, but monitoring is ongoing.

Attackers’ tools

Among the tools used, researchers have noted a 150 KB web shell masquerading as a legitimate WordPress security plugin called CMSmap. Available information suggests it is a fully featured attack platform supporting file management, database access, port scanning, bulk code injection, and several privilege-escalation modules, including exploitation of MySQL UDF. It should be noted that these details are not supported by a direct primary source in the publicly available materials.

There have also been observed cases of deploying fake WordPress plugins for code execution and loading secondary tools. In at least one case, the attacker repeatedly attempted to install Overlord RAT, a remote access trojan written in Go.

Impact assessment

The scale of potential damage is driven by several factors. WordPress remains the most widely used CMS in the world, and the wp2shell chain does not require plugins or special configuration — a basic installation is vulnerable. The Wiz data point that 60% of organizations had vulnerable instances should be interpreted with a caveat: it comes from the telemetry of a single cloud provider and may not reflect the state of all WordPress deployments. Nevertheless, even accounting for this, the scale of the issue remains significant.

The absence of confirmed data exfiltration at this stage should not be reassuring: the creation of backdoor administrator accounts and installation of web shells represents establishment of persistent access that can later be monetized through extortion, defacement, spam campaigns, or using compromised servers as infrastructure for further attacks.

Response recommendations

The response priority is immediate. Recommended actions:

1. Update WordPress to the latest patched version. If updating is not possible right now, enable a persistent object cache, which, according to Cloudflare, blocks the RCE vector for CVE-2026-63030.
2. Perform an audit even after patching. Review the list of administrators for unknown accounts. Check installed plugins for suspicious or unfamiliar items, especially anything named CMSmap or with an atypical size.
3. Check the file system for PHP files in nonstandard locations, especially minimal web shells and files that appeared after the vulnerability disclosure date.
4. Rotate secrets: if compromise is suspected, change all administrator passwords, WordPress authentication keys (AUTH_KEY, SECURE_AUTH_KEY and others in wp-config.php), and database credentials.
5. Review logs for anomalous requests to the REST API, especially to the batch endpoint, and for requests with the author__not_in parameter.

The fact that wp2shell is under active mass exploitation with zero prerequisites for attack makes this vulnerability chain one of the most dangerous threats to the WordPress ecosystem in recent years. Patching and auditing for signs of compromise are not sequential but parallel tasks: updating without checking for already installed backdoors leaves attackers’ access to the system intact.