CVE-2026-63030 and CVE-2026-60137 are being actively exploited to plant persistent PHP webshells and malicious plugins on WordPress sites, according to multiple technical reports and incident timelines published after the vulnerability disclosure.
How attackers are abusing the wp2shell chain (Wiz observations)
Cloud security company Wiz cataloged a consistent pattern of activity tied to the wp2shell vulnerability suite: mass-scanning for vulnerable WordPress installations, abuse of the plugin upload mechanism to install malicious add-ons, and installation of PHP webshells that range from one-line backdoors to obfuscated, feature-rich shells disguised as plugins (CMSmap). Wiz also reported query activity against the WordPress REST API to harvest administrator usernames and email addresses, local file inclusion attempts via admin-ajax.php aimed at wp-config.php to retrieve database credentials and authentication keys, deployment of a malicious plugin that exposes a REST API endpoint for remote command execution, and successful access to WordPress administration panels. Wiz said it has not observed lateral movement or data exfiltration so far but continues to monitor the activity.
Two-stage attacks and webshell placement (Johannes B. Ullrich, Sans Technology Insitute)
Johannes B. Ullrich, Dean of Research at Sans Technology Insitute, described a two-stage attack pattern in which adversaries probe for SQL injection to confirm vulnerability, then deliver a PHP webshell. Ullrich reported that the webshells were created under /wp-content/cache/ and that accessing the page returned a fake 404 error. He also said some attacks involved creating rogue administrator accounts and recommended checking the /cache/ directory and looking for newly created users.
Timeline detail: early probing and rapid exploitation (Defiant)
WordPress security firm Defiant published an “aftermath” post putting the first exploitation-related probing at 23:29 UTC on July 17; a clear SQL injection attempt followed 13 minutes later. Proof-of-concept exploits began to appear over the weekend after SearchLight Cyber disclosed the wp2shell security issue, and active exploitation was confirmed shortly after WordPress issued patches.
Patch rollout and measured uptake (WordPress, Macnica)
WordPress released fixes in versions 7.0.2, 6.9.5, and 6.8.6 and forced automatic security updates for supported installations. Macnica researcher Yutaka Sejiyama published a live dashboard that tracks patch uptake and reported an 81.6% patch rate in a sample of 124,580 websites evaluated. SearchLight Cyber’s initial disclosure was followed by a deeper report from researcher Adam Kues that detailed how the wp2shell issue was discovered and how a working exploit chain was developed, which Kues said involved using AI tools.
Immediate actions administrators are advised to take
Sources reporting on the incident converge on the same urgent checklist: administrators should immediately update to the patched WordPress versions, review logs for wp2shell-related requests, inspect installed plugins for signs of tampering, and check for rogue PHP files or newly created administrative accounts. Ullrich’s account adds a specific place to inspect — the /wp-content/cache/ directory — and Defiant’s timeline underscores how quickly probes and injection attempts began after disclosure.
What this means for technologists, hosting providers, and security teams
- Technologists and security teams: Track and triage wp2shell indicators in web and application logs, verify plugin integrity, and prioritize host-level scans for unexpected PHP files in /wp-content/cache/ and similar writable locations.
- Hosting providers and site administrators: Ensure automatic updates have applied the 7.0.2 / 6.9.5 / 6.8.6 fixes across supported installations and inspect tenant sites for signs of webshells or new admin accounts.
- Security operations and incident response teams: Correlate REST API access patterns and admin-ajax.php requests with post-exploitation behaviors described by Wiz and Ullrich, and remain alert for malicious plugins that expose command-execution endpoints.
The record from multiple technical sources is consistent: a remote, unauthenticated exploit chain against the WordPress REST API’s batch-processing capability enabled attackers to upload persistent webshells and malicious plugins, proof-of-concepts appeared rapidly after disclosure, and opportunistic mass-scanning followed. With an 81.6% patch rate reported in a large sample but active exploitation observed in the wild, the remaining unpatched instances represent clear targets for the same tactics described by Wiz, Ullrich, and Defiant.
Original reporting: https://www.bleepingcomputer.com/news/security/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/
