CVE-2026-60137 & CVE-2026-63030: WP2Shell WordPress Exploitation — Detection and Hardening Guide | Security Arsenal

Security operations centers (SOCs) globally are observing active exploitation of the critical "WP2Shell" vulnerabilities, tracked as CVE-2026-60137 and CVE-2026-63030, impacting WordPress environments. Disclosure of these vulnerabilities was almost immediately followed by weaponization, with threat actors scanning for and compromising unpatched instances to deploy web shells. Given WordPress' dominance in the web content management market, these CVEs present a severe risk of widespread ransomware deployment and data exfiltration. This is not a theoretical risk; this is an active intrusion campaign requiring immediate incident response posture.

Technical Analysis

Affected Platforms: WordPress Core and associated plugins (specifics referenced in vendor advisories regarding WP2Shell). All Linux-based hosting environments (Apache/Nginx/PHP-FPM) are primary targets.

CVE Identifiers:

CVE-2026-60137: Critical severity remote code execution (RCE) flaw.
CVE-2026-63030: Critical severity authentication bypass or file upload vulnerability leading to RCE.

Vulnerability Mechanics: The "WP2Shell" moniker derives from the attack chain: the vulnerabilities allow an unauthenticated attacker to upload a malicious file or inject code into a vulnerable PHP process. This flaw bypasses standard security controls (like file type validation or user authentication checks), resulting in the attacker writing a web shell (typically a PHP script) to the web directory. Once written, the attacker can execute arbitrary system commands on the host with the privileges of the web server user (e.g., www-data).

Exploitation Status:

Status: Confirmed Active Exploitation in the Wild (ITW).
Availability: Proof-of-Concept (PoC) exploit code has been observed circulating on underground forums shortly after disclosure.

Detection & Response

Detection of WP2Shell requires identifying the initial web shell upload and the subsequent abnormal process execution. Standard web application firewall (WAF) logs may show the attempted exploit, but endpoint telemetry is required to confirm successful compromise.

Sigma Rules

YAML

---
title: WP2Shell Web Server Spawning Shell
id: 8a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects web server processes spawning shell utilities, indicative of web shell activity related to CVE-2026-60137 or CVE-2026-63030.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.004
  - attack.web_shell
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/python'
      - '/perl'
      - '/nc'
      - '/telnet'
  condition: selection
falsepositives:
  - Legitimate administrative scripts run by web developers
level: critical
---
title: WordPress WP2Shell PHP File Creation in Uploads
id: 9c3d2e1f-0a1b-2c3d-4e5f-6a7b8c9d0e1f
status: experimental
description: Detects creation of PHP files in WordPress uploads directories, a common tactic for WP2Shell persistence.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: file_creation
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/wp-content/uploads/'
    TargetFilename|endswith:
      - '.php'
  condition: selection
falsepositives:
  - Rare legitimate plugin behavior (investigate immediately)
level: high

KQL (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender

// Hunt for web server processes spawning shells (WP2Shell activity)
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName has_any ("apache", "httpd", "nginx", "php-fpm")
| where FileName has_any ("bash", "sh", "zsh", "python", "perl", "nc", "wget", "curl")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, CommandLine, AccountName
| order by Timestamp desc


// Hunt for suspicious PHP file creation in WordPress directories
DeviceFileEvents
| where Timestamp > ago(1d)
| where FolderPath contains "wp-content/uploads"
| where FileName endswith ".php"
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessAccountName
| order by Timestamp desc

Velociraptor VQL

VQL — Velociraptor

-- Hunt for recently modified PHP files in WordPress uploads
SELECT FullPath, Size, Mtime, Atime, Mode
FROM glob(globs='/var/www/html/*/wp-content/uploads/**/*.php')
WHERE Mtime > now() - 24h

-- Hunt for web server processes spawning shells
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ 'apache|nginx|php-fpm')
  AND Name =~ 'bash|sh|python|perl|nc'

Remediation Script (Bash)

Bash / Shell

#!/bin/bash

# WP2Shell Response Script: Checks for common web shell signatures and recent PHP files in uploads
# Usage: sudo ./check_wp2shell.sh

echo "[*] Checking for recent PHP files in wp-content/uploads (last 24h)..."
find /var/www/html -type d -name "uploads" -exec find {} -name "*.php" -mtime -1 -print {} \;

echo "[*] Checking for common web shell signatures (base64_decode, eval, shell_exec) in uploads..."
find /var/www/html -type d -name "uploads" -exec grep -lR "base64_decode" {} + 2>/dev/null | head -n 10

echo "[*] Verifying WordPress core integrity (requires wp-cli or version check)..."
# Ensure you have wp-cli installed for deeper checks or check readme.html version
find /var/www/html -name "readme.html" -exec grep -H "Version" {} \;

echo "[!] Immediate Action Required: Patch CVE-2026-60137 and CVE-2026-63030 immediately via WP Admin or CLI."

Remediation

Immediate Patching: Update WordPress Core and all plugins immediately. While CVE-2026-60137 and CVE-2026-63030 may target specific components, updating the entire stack is the only safe assumption. Verify you are running the latest patched versions released by the vendor in response to this advisory.
Compromise Assessment: Assume that if your site was vulnerable prior to patching, it is compromised. Perform a thorough scan for web shells using the VQL and Sigma rules above. Look for PHP files in wp-content/uploads, wp-content/cache, or random directories outside the standard structure.
Server Hardening: Ensure the web server user (e.g., www-data) does not have write access to the WordPress core directories. Disallow PHP execution in the wp-content/uploads directory via your web server configuration (Apache/Nginx).
Credential Rotation: If a compromise is confirmed, treat it as a full breach. Rotate all database credentials, WordPress admin passwords, and hosting SSH keys. Threat actors often install backdoors that survive simple patching.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

CVE-2026-60137 & CVE-2026-63030: WP2Shell WordPress Exploitation — Detection and Hardening Guide