Widespread Exploitation of WP2Shell Vulnerabilities Threatens Millions of WordPress Sites with Unauthenticated Remote Code Execution

The global cybersecurity landscape is currently grappling with a high-severity threat as attackers begin the mass exploitation of a newly discovered vulnerability chain in WordPress, the world’s most popular content management system. Tracked as CVE-2026-63030 and CVE-2026-60137, the dual flaws have been collectively dubbed "wp2shell." When combined, these vulnerabilities allow unauthenticated attackers to achieve remote code execution (RCE), effectively granting them total control over a target website without requiring any prior access, user interaction, or specific plugin configurations.

Security researchers have warned that the exploit is being deployed against a wide array of targets, ranging from small personal blogs to large-scale enterprise environments. According to telemetry from multiple security firms, the transition from the disclosure of the vulnerabilities to active, widespread exploitation occurred with alarming speed, highlighting the sophisticated nature of modern threat actors and the critical risk posed to the WordPress ecosystem.

Technical Architecture of the wp2shell Exploit Chain

The wp2shell exploit is particularly dangerous because it targets the core architecture of WordPress rather than third-party extensions. The attack utilizes a two-part chain to bypass security protocols that usually protect the administrative backend of a website.

The first link in the chain is CVE-2026-60137, a critical route confusion bug located within the WordPress REST API’s batch endpoint. Under normal circumstances, the REST API requires various levels of authentication to perform sensitive actions. However, this specific flaw allows an anonymous user to confuse the internal routing logic of the API. By doing so, an attacker can invoke internal handlers and administrative functions that should be restricted. Essentially, the bug acts as an "open door," allowing unauthorized requests to reach the deeper layers of the WordPress core.

Once the attacker has bypassed the initial authentication layer via the REST API, they leverage the second vulnerability, CVE-2026-63030. This flaw is a SQL injection vulnerability found within the WP_Query class, specifically involving the author__not_in parameter. This parameter is intended to filter search results by excluding specific authors, but it suffers from improper sanitization.

When an attacker passes crafted, malicious input through this parameter, they can alter the structure of the underlying database query. In environments where a persistent object cache—such as Redis or Memcached—is not in use, this SQL injection can be escalated to achieve full remote code execution. This escalation allows the attacker to run arbitrary commands on the underlying web server, leading to a complete system compromise.

The Role of AI in Vulnerability Discovery

A significant aspect of the wp2shell discovery is the methodology used to find it. The exploit chain was identified by researchers at Searchlight Cyber using OpenAI’s GPT 5.6 Sol. Reports indicate that the AI model was able to identify the complex interaction between the REST API and the WP_Query class in just over 10 hours of analysis—a task that might take human researchers weeks or months of manual code auditing.

This development marks a pivotal moment in the intersection of artificial intelligence and cybersecurity. While AI has long been used for defensive purposes, such as anomaly detection and automated patching, its ability to autonomously discover sophisticated "zero-day" style exploit chains in widely used software underscores a shifting paradigm. The severity of the issue was so high that technical details were initially withheld by the researchers to allow the WordPress security team time to coordinate a response, though threat actors were quick to develop their own versions of the exploit once the general nature of the flaws became public.

Chronology of the Outbreak

The timeline of the wp2shell exploitation reflects a rapid escalation from discovery to global crisis:

• Late 2025: WordPress versions 6.8 and 6.9 are released, introducing the code changes that inadvertently contained the vulnerabilities.
• Early June 2026: Searchlight Cyber utilizes GPT 5.6 Sol to identify the RCE chain in stock WordPress installations.
• Mid-June 2026: Coordination begins between researchers and the WordPress core security team to develop patches.
• Saturday Morning (UTC): Shortly after the public disclosure of the CVEs, security firm watchTowr observes the first wave of successful exploitations. Initial attacks focus on exfiltrating hashed credentials from the WordPress database.
• Saturday Afternoon (UTC): As more technical nuances of the exploit become public, attackers shift their focus toward achieving full RCE.
• Sunday: Global telemetry identifies thousands of unique IP addresses participating in "spray and pray" style scanning campaigns.

Jake Knott, principal security researcher at watchTowr, noted that successful exploitation was well underway by the early hours of the weekend. "From our vantage point across a global client base, we are seeing widespread impact of this vulnerability across organizations of every size and every vertical," Knott stated.

Global Impact and Telemetry Data

The reach of the wp2shell campaign is truly international. Data captured by KEVIntel has linked the exploitation of CVE-2026-63030 to 13 unique, high-volume IP addresses originating from a diverse set of countries, including Switzerland, Germany, the United Kingdom, Indonesia, Lithuania, the Netherlands, and Singapore. This suggests a coordinated effort by multiple threat actor groups or the rapid adoption of the exploit by various independent "botnet" operators.

Research from Wiz, a cloud security leader, provides a sobering look at the scale of the exposure. According to their analysis, approximately 60% of organizations utilizing WordPress had at least one vulnerable instance at the time the CVEs were published. Perhaps more concerning is the fact that 25% of these organizations were exposing a vulnerable server directly to the public internet without any secondary layers of protection, such as a Web Application Firewall (WAF) configured to block the specific exploit patterns.

Cloudflare’s security team also weighed in, clarifying that while the SQL injection (CVE-2026-60137) affects version 6.8 and above, the full RCE chain (CVE-2026-63030) primarily impacts versions from 6.9 onwards. They emphasized that the lack of a persistent object cache is the primary prerequisite for the transition from SQL injection to code execution, a configuration common in many standard shared hosting environments.

Post-Exploitation Tactics and Payload Analysis

Once an attacker gains access through the wp2shell exploit, they typically move quickly to establish persistence and expand their footprint within the network. Security researchers have observed several distinct post-exploitation behaviors:

1. The CMSmap Web Shell

One of the most common payloads identified is a 150 KB web shell disguised as a legitimate WordPress plugin named "CMSmap." This is not merely a simple script but a "full-featured attack platform." It provides the attacker with a graphical interface to manage files, access the database, perform port scanning on the internal network, and inject batch code into other legitimate files on the server. Furthermore, it includes modules for privilege escalation, including the exploitation of MySQL User-Defined Functions (UDF) to gain root-level access to the server.

2. Creation of Backdoor Administrator Accounts

Attackers are frequently observed creating new administrator accounts with randomized names. Over 100 such backdoor accounts have been identified in the wild. These accounts allow the threat actor to log in through the standard WordPress portal, making their presence appear legitimate to casual observers and allowing them to install further malicious plugins or change site settings at will.

3. Deployment of Overlord RAT

In more targeted attacks, researchers have observed the attempted installation of the "Overlord RAT." This is a sophisticated remote access trojan written in the Golang programming language. Golang is a popular choice for modern malware because it allows for easy cross-platform compilation and can be difficult for traditional antivirus engines to signature. The Overlord RAT provides attackers with a persistent "command and control" (C2) link, allowing for data exfiltration and the deployment of secondary malware, such as ransomware.

Industry Response and Mitigation Strategies

The WordPress core team has released emergency updates to address these vulnerabilities. However, because of the "unauthenticated" nature of the exploit, the window for patching is extremely narrow. Security experts are urging administrators to take immediate action.

The primary recommendation is to update WordPress to the latest patched version immediately. For those unable to update instantly, implementing a persistent object cache (like Redis) can mitigate the RCE portion of the exploit, though the SQL injection risk remains. Additionally, organizations should deploy WAF rules specifically designed to intercept the REST API batch endpoint "route confusion" patterns.

Wiz researchers Shahar Dorfman and Gili Tikochinski noted that while they have observed high-volume scanning, much of it is opportunistic. "We’ve observed high-volume scanning activity without subsequent post-exploitation, suggesting opportunistic mass-scanning campaigns seeking to identify vulnerable targets," they said. However, they warned that this is often a precursor to more targeted, damaging attacks.

Defenders are also advised to conduct a thorough forensic audit of their WordPress installations. This includes:

• Checking the user database for any unauthorized administrator accounts created after the vulnerability disclosure.
• Auditing the wp-content/plugins directory for unfamiliar folders, particularly those named "CMSmap" or other generic security-sounding names.
• Reviewing server access logs for unusual POST requests directed at the /wp-json/batch/v1 endpoint.
• Scanning the server for Golang-based binaries or unusual outbound connections to unknown IP addresses.

Broader Implications for the Web Ecosystem

The wp2shell crisis serves as a stark reminder of the inherent risks associated with the monoculture of the web. With WordPress powering over 40% of all websites, a single core vulnerability can have global economic and security implications. The speed at which this exploit was developed and deployed—aided by the same AI technologies intended to help humanity—suggests that the "arms race" between attackers and defenders is entering a new, more volatile chapter.

As organizations continue to apply fixes and root out intruders, the cybersecurity community is left to reflect on the necessity of "security by design." The fact that a stock install of the world’s most popular CMS could be compromised with a single HTTP request in 2026 highlights the ongoing challenges of securing legacy codebases against modern, AI-enhanced threats. For now, the priority remains clear: patch, verify, and remain vigilant against the persistent shadow of wp2shell.