Tia N.List

Reported by 7 outlets

wp2shell — CISA Adds to KEV; Wiz Details Webshell Installation at Scale

hot0.0
Why this score
Breadth
2.00 / 2.0 · 7 sources
Authority
1.80 / 2.0 · best outlet weight
Severity
5.00 / 5.0 · CVSS + KEV signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.60 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
bleepingcomputer.comslcyber.iowordpress.orggithub.comrapid7.comcyberpress.orggbhackers.com CVE-2026-60137CVE-2026-63030 KEV desk first seen 88d ago

Desk analysis

wp2shell is a pre-authentication RCE chain in WordPress Core, disclosed July 17, 2026 through coordinated advisories. CVE-2026-63030 (GHSA-ff9f-jf42-662q, Critical, CVSS 7.5) is REST API batch-route confusion introduced in WordPress 6.9; chained with CVE-2026-60137 (GHSA-fpp7-x2x2-2mjf, Moderate), a SQL injection in WP_Query's author__not_in parameter present since 6.8, it gives an anonymous attacker code execution on versions 6.9.0-6.9.4 and 7.0.0-7.0.1 with no plugins and no preconditions. The disclosure record behind this story is richer than its event trail shows: Searchlight Cyber researcher Adam Kues found the chain, the companion SQL injection is credited to TF1T, dtro, and haongo, and WordPress shipped 7.0.2 and 6.9.5 the same day, with 6.8.6 covering the SQL injection alone and nothing before 6.8 affected. Searchlight deliberately withheld technical details and launched the wp2shell.com exposure checker at disclosure, while forced auto-updates pushed the fixes to installations that accept them.

The severity here is the denominator, not the score. WordPress runs roughly 500 million sites, about 43 percent of the web, and the vulnerable path is reachable on default installs without a persistent object cache, which is most of them. Exploitation outran most patch cycles: public PoCs and first in-the-wild signs appeared within a day, Patchstack and Hexastrike honeypots recorded traffic the same weekend, and CISA put both CVEs in KEV on July 21, triggering federal remediation requirements. The GreyNoise report then changes the category of risk from opportunistic scanning to espionage: a single suspected Chinese-speaking operator, tracked since early June, active in a UTC+8 pattern and possibly linked to Acronis' Red Heron campaign, folded wp2shell into a broader campaign on July 20, three days after patches landed, and went on to compromise at least 49 organizations across 29 countries, stealing 18,566 records from one Western government body. The intrusion detail carries the real lesson: the actor dumped the user table for 13 administrator accounts, created a rogue admin with a backdated registration date, and profiled the Windows server for security tools and database software, so patching closes the entry path but not the foothold; every confirmed victim must treat credentials, plugin inventory, and database secrets as already burned.

Verification and containment are concrete. Confirm internet-facing sites run 7.0.2, 6.9.5, or 6.8.6 or later, and use Searchlight Cyber's wp2shell.com checker plus Cloudflare WAF rules, which cover all plans including free, as a stopgap. Where patching lags, block /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF or install a plugin cutting anonymous REST API access, accepting both are temporary measures that break legitimate functionality. Hunt for unauthenticated POSTs to /wp-json/wp/v2/ and the batch endpoint carrying author__not_in or batch parameters, inventory wp-content/plugins for plugin-named files that are really PHP webshells, the range Wiz documented from one-liners to obfuscated CMSmap-style shells, and diff wp_users for administrators whose user_registered dates were edited after creation, the exact forgery GreyNoise observed. On any host showing those traces, rotate admin passwords and the database credentials stored in wp-config.php, which Wiz saw attackers retrieve through local file inclusion, and expect post-exploitation enumeration of local users, network services, and database software on Windows servers.

Two developments would move this assessment. Searchlight Cyber is still holding technical detail, so a full weaponized pre-auth exploit would collapse the current gap between crude PoCs that must crack extracted password hashes and the reliable single-request chain the advisories describe; a published technical writeup or Wiz and GreyNoise releasing shell and C2 signatures would similarly widen the hunting gap. Second, formal attribution linking the UTC+8 operator to Red Heron, or a rising count from 49 organizations and 18,566 records, would upgrade wp2shell from a mass-exploitation event to a named government-targeting campaign, changing it from a patch sprint into an incident-response problem for every federal system the KEV deadline covers.

Timeline

  1. original reporting

    wp2shell — CISA Adds to KEV; Wiz Details Webshell Installation at Scale

    bleepingcomputer.com · 84d ago · July 22nd, 2026

    Previously covered July 18-21 (initial disclosure, public exploits, active exploitation). New today: CISA adds both CVEs to KEV; Wiz publishes attack telemetry.

    CISA added both wp2shell CVEs — CVE-2026-63030 (interpretation conflict) and CVE-2026-60137 (SQL injection) — to the Known Exploited Vulnerabilities catalog on July 21, triggering federal remediation requirements.

    Meanwhile, Wiz published detailed telemetry showing observed attacker activity post-exploitation:

    • Mass-scanning for vulnerable WordPress installations

    • Abuse of WordPress plugin upload functionality to install malicious plugins

    • Installation of PHP webshells ranging from simple one-liners to feature-rich, obfuscated shells disguised as plugins (CMSmap)

    • Local file inclusion attempts targeting wp-config.php to retrieve database credentials

    • Querying REST API to collect administrator usernames and email addresses

    The CISA KEV addition and Wiz telemetry confirm that wp2shell exploitation is accelerating, not slowing, as defenders race to patch hundreds of millions of WordPress sites.

    Action: If you haven't patched to 7.0.2/6.9.5/6.8.6, assume compromise. Check for unauthorized plugins and webshells. Change all WordPress admin credentials.

  2. update from slcyber.io

    wp2shell: Pre Authentication RCE in WordPress Core

    slcyber.io · 89d ago · July 17th, 2026

    Searchlight Cyber's security research team, credited to Adam Kues, disclosed a pre-authentication RCE in WordPress Core exploitable by an anonymous user on a stock install with no plugins, affecting 6.9.0-6.9.4 and 7.0.0-7.0.1 while versions 6.8.5 and earlier are not affected. The firm withheld technical details at disclosure to give defenders time to patch and launched wp2shell.com, a public checker for vulnerable instances. It recommended updating to 7.0.2 or 6.9.5, or as temporary measures blocking /wp-json/batch/v1 and ?rest_route=/batch/v1 at a WAF or installing a plugin that blocks anonymous REST API access.

  3. update from wordpress.org

    WordPress 7.0.2 Release

    wordpress.org · 89d ago · July 17th, 2026

    The vendor advisory shipped 7.0.2 addressing one critical and one high severity security issue and enabled forced updates via the auto-update system for sites running affected versions. It credits Adam Kues at Assetnote / Searchlight Cyber for the REST API batch-route confusion and SQL injection leading to Remote Code Execution, and the team of TF1T, dtro, and haongo for a facilitated SQL injection. Backports shipped as 6.9.5 for both issues and 6.8.6 for the SQL injection alone, versions prior to 6.8 are not affected, and 7.1 beta2 also received fixes. It lists GHSA-ff9f-jf42-662q (CVE-2026-63030) and GHSA-fpp7-x2x2-2mjf (CVE-2026-60137).

  4. update from github.com

    GHSA-ff9f-jf42-662q: REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

    github.com · 89d ago · July 17th, 2026

    The advisory notes the vulnerability was discovered and responsibly disclosed by Adam Kues at Assetnote / Searchlight Cyber.

  5. mentioned by github.com

    GHSA-fpp7-x2x2-2mjf: Facilitated SQL injection vulnerability in the author__not_in parameter of WP_Query

    github.com · 89d ago · July 17th, 2026

  6. update from rapid7.com

    CVE-2026-63030 (wp2shell) — Critical Pre-Auth WordPress Core RCE

    rapid7.com · 88d ago · July 18th, 2026

    CVE-2026-63030 (CVSS 7.5) exploits the WordPress REST API batch endpoint, allowing an unauthenticated attacker to execute arbitrary code on default WordPress installations without requiring additional plugins. Rapid7 notes that the vulnerable code path is reachable when a persistent object cache is not in use — the default for many WordPress deployments. No public exploitation has been confirmed at time of publication, but Rapid7 assesses that a public PoC is highly likely given the open-source nature of WordPress and the accessibility of AI-assisted code analysis. Action: Update WordPress immediately. Verify all internet-facing WordPress sites have been upgraded to 6.9.5, 7.0.2, or later. With WordPress powering ~43% of all websites, the attack surface is massive.

  7. update from bleepingcomputer.com

    wp2shell — Public Exploits Released, In-the-Wild Exploitation Confirmed

    bleepingcomputer.com · 87d ago · July 19th, 2026

    New: Public PoC exploits published on GitHub; watchTowr confirms first signs of in-the-wild exploitation; WordPress forces automatic updates.*

    The situation with the wp2shell pre-authentication RCE chain (CVE-2026-63030 + CVE-2026-60137) has escalated significantly. Some public PoCs extract password hashes via SQLi and crack an admin password to upload a malicious plugin; others claim pre-auth RCE without credentials. Cloudflare has deployed WAF rules across all plans (including free) for both CVEs. Action: This is now an actively exploited, pre-auth RCE affecting ~500 million websites. Patch to WordPress 6.9.5 or 7.0.2 immediately.

  8. update from

    WP2Shell — WordPress Pre-Auth RCE Chain Actively Exploited

    · 86d ago · July 20th, 2026

    Multiple security firms confirm in-the-wild exploitation: Patchstack, Hexastrike (honeypot hits over the weekend with active incident response), and WatchTowr all report attack traffic. WordPress runs on hundreds of millions of sites — hosting-provider auto-patching will cover some, but manually maintained installations are wide open.

  9. update from cyberpress.org

    Hackers Breach Government WordPress Site and Steal 18,566 Records With Plaintext Passwords

    cyberpress.org · 21d ago · September 22nd, 2026

    The breach was part of a wider campaign targeting vulnerable WordPress installations worldwide. The activity from May 7, 2026 onward to a single malicious cyber actor believed to be a Chinese-speaking operator, possibly active in the UTC+8 time zone. The actor is suspected to be the same group, or linked to, the “Red Heron” campaign previously reported by Acronis. GreyNoise said the threat actor began exploiting WordPress sites around July 20 using the wp2shell exploit chain, involving CVE-2026-63030 and CVE-2026-60137. The campaign successfully compromised at least 49 organizations across 29 countries, mainly affecting government and small-business targets. WordPress Breach Exposes Passwords The government intrusion began on July 22, when the attacker used the WordPress exploit chain to deploy a custom web shell on the targeted server. Within minutes, the actor extracted the WordPress user table, stealing 13 administrator accounts. The attackers then accessed the WordPress administration panel and created a new account designed to appear legitimate. They altered its registration date to make it blend in with the victim’s existing account history. After gaining access, the threat actor uploaded a custom information-gathering plugin and used the web shell to inspect the Windows-based server environment. The attacker searched for security tools, local users, network services, database software, WordPress configuration files, and security settings.

  10. update from gbhackers.com

    Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data

    gbhackers.com · 21d ago · September 22nd, 2026

    GreyNoise linked the activity to a malicious cyber actor (MCA) it has tracked through its Global Observation Grid since early June. The […] The post Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

  11. update from github.com

    🤖 WordPress WP2Shell chain: CVE-2026-63030 (REST API batch route confusion) + CVE-2026-60137 (WP_Query author__not_in SQLi) → unauth SQLi to

    github.com · 16d ago · September 27th, 2026

    🤖 WordPress WP2Shell chain: CVE-2026-63030 (REST API batch route confusion) + CVE-2026-60137 (WP_Query author__not_in SQLi) → unauth SQLi to

    via Mastodon https://github.com/jed-parsec/CVE-2026-63030-60137-wp2shell-lab

Source on GitHub