The wp2shell vulnerability (CVE-2026-63030 and CVE-2026-60137) is a critical pre-authentication remote code execution chain affecting WordPress Core versions 6.9.0 through 7.0.1. The flaw originates from route confusion within the WordPress REST API batch handling, allowing attackers to escalate a SQL injection primitive into full system compromise. Public proof-of-concept tools, such as the Icex0 PoC, have already been released, leading to active exploitation in the wild.
Defensive analysis using Elastic Defend reveals a distinct attack pattern involving web server runtimes (like Apache or PHP-FPM) spawning shell processes and creating malicious plugin directories under wp-content/plugins/. Effective detection relies on behavioral rules that monitor for unusual command execution from web server parents rather than static indicators. Administrators are urged to patch to WordPress versions 7.0.2 or 6.9.5 immediately and monitor for unauthorized file modifications or suspicious process lineage.
Top comments (0)