Two linked WordPress flaws, tracked as CVE-2026-63030 and CVE-2026-60137 and collectively dubbed "wp2shell," have been weaponized in the wild. When chained, the vulnerabilities enable unauthenticated remote code execution (RCE) on default WordPress installations and have prompted mass scanning and follow‑on compromise activity across many environments.
CVE-2026-63030 and CVE-2026-60137: the wp2shell chain
The exploitation path uses a two-part chain. Intruder's Ben Marr described CVE-2026-60137 as the entry point: "a route confusion bug in the REST API batch endpoint that bypasses authentication, allowing an attacker to invoke internal handlers without any permission check." The underlying problem arises when the 'author__not_in' parameter is improperly sanitized within WP_Query and receives untrusted data from a plugin or theme, enabling a crafted input to alter database queries.
Cloudflare noted that CVE-2026-63030 enables unauthenticated RCE only when persistent object cache is not in use. According to published version details, the SQL injection issue (CVE-2026-60137) is present from WordPress version 6.8 onward; the unauthenticated RCE impacts versions from 6.9. Searchlight Cyber reported the exploit chain permits unauthenticated RCE on default WordPress installations in any WordPress version released since December 2025.
Searchlight Cyber discovery and the disclosure context
Searchlight Cyber said it discovered the exploit chain using OpenAI GPT 5.6 Sol in just over ten hours; the company has withheld technical details in light of the issue's severity. WatchTowr reported that, "By the early hours of Saturday morning (UTC), successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public."
Telemetry and mass scanning: KEVIntel, watchTowr, and honeypots
Multiple telemetry sources show active, wide-reaching abuse. KEVIntel linked exploitation of CVE-2026-63030 to 13 unique IP addresses across Switzerland, Germany, the U.K., Indonesia, Lithuania, the Netherlands, and Singapore. WatchTowr said its honeypots registered "tens of thousands of exploitation attempts" after a public exploit was released, and defenders are seeing indiscriminate spraying across the Internet.
Wiz researchers also reported "high-volume scanning activity without subsequent post-exploitation," characterizing some of the traffic as opportunistic mass‑scanning campaigns operating alongside legitimate security scans.
Post-exploitation tooling and observed attacker actions
- Wiz documented a pattern of post‑exploit behavior including uploading malicious plugins, enumerating users and harvesting admin usernames and email addresses, carrying out local file inclusion (LFI) to target database credentials and authentication keys, accessing admin panels and authenticating, and uploading PHP web shells that facilitate remote code execution.
- WatchTowr detailed the creation of more than 100 backdoor administrator accounts after exploitation; attackers deployed fake WordPress plugins to gain code execution or to download secondary tools.
- At least one threat actor repeatedly attempted to install Overlord RAT, a Golang-based remote access trojan, in an observed case.
- Researchers discovered a roughly 150 KB web shell disguised as a legitimate WordPress security plugin named CMSmap. That artifact functions as a "full-featured attack platform" with file management, database access, port scanning, batch code injection, and multiple privilege escalation modules including MySQL UDF exploitation.
- Wiz noted that, so far, it has "yet to identify lateral movement or data exfiltration" beyond the described credential and key harvesting, but monitoring continues.
What this means for WordPress site operators, security teams, and cloud tenants
WordPress site operators are urged to inspect instances for newly created administrator accounts, malicious plugins, or suspicious files regardless of whether they have applied patches: this is the specific remediation guidance reported by defenders. Security teams should hunt for bare‑bones PHP web shells, CMSmap‑style plugins, signs of LFI and credential theft, and indicators of attempts to deploy remote access trojans such as Overlord RAT. Cloud tenants and administrators should note Wiz's early exposure metrics: when the CVEs were published, 60% of organizations using WordPress had at least one vulnerable instance and 25% were exposing a vulnerable server directly to the Internet — figures that have declined as fixes were applied.
The release of a public exploit accelerated opportunistic abuse and mass scanning, turning a severe but initially technical chain into a broadly exploitable threat. Defenders now face two practical tasks: patch and harden affected WordPress versions, and perform forensic sweeps for backdoor accounts, malicious plugins, and web shell artifacts left by attackers. The timeframe between public exploit publication and widespread compromise in this case underscores how quickly automated scanning and commodity tooling can turn research into active campaigns.
