CVE-2026-63030 & CVE-2026-60137: WordPress Core Unauthenticated RCE — Detection and Remediation

The WordPress ecosystem is currently facing a critical threat following the disclosure of a vulnerability chain dubbed "wp2shell." By chaining two distinct vulnerabilities—CVE-2026-63030 and CVE-2026-60137—unauthenticated attackers can achieve Remote Code Execution (RCE) on affected servers.

Security Arsenal is tracking this situation with high urgency. Multiple security firms have confirmed active exploitation in the wild (ITW) within days of the public disclosure on July 17, 2026. Given that WordPress powers a significant portion of the web, the potential surface area for automated scanning and compromise is massive. Defenders must treat this as a critical incident and assume that automated botnets are already probing for vulnerable instances.

Technical Analysis

Affected Products & Versions:

• Product: WordPress Core
• Affected Versions: 6.9.x and 7.0.x
• Platform: Linux/Unix web servers (typically Apache/Nginx with PHP)

The Vulnerability Chain: This attack relies on chaining two separate vulnerabilities to bypass security controls:

1. CVE-2026-63030: An initial flaw that allows an attacker to interact with the application in a way that exposes a secondary attack surface.
2. CVE-2026-60137: A second vulnerability, likely related to file handling or serialization, that is triggered to execute arbitrary code.

The result is pre-authentication unauthenticated RCE. This means the attacker does not need valid credentials (username/password) or a user session to execute commands on the underlying operating system. The web server user (typically www-data) is compromised, allowing the attacker to read sensitive files (e.g., wp-config.php), move laterally, or deploy webshells.

Exploitation Status:

• ITW Exploitation: Confirmed by multiple vendors.
• PoC Availability: Public proof-of-concept exploits are circulating, lowering the barrier to entry for script-kiddies and automated scanners.
• Public Disclosure: July 17, 2026.

Detection & Response

Detecting this vulnerability requires looking for the successful outcome of the exploit—specifically, the web server process spawning unexpected shells or network tools—rather than just the initial HTTP request, which may be obfuscated.

SIGMA Rules

The following Sigma rules identify the behavior of a successful wp2shell exploitation: a web server process spawning a reverse shell or system reconnaissance tool.

---
title: WordPress wp2shell Exploit - Web Server Spawning Shell
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects potential exploitation of CVE-2026-63030/CVE-2026-60137 (wp2shell) by identifying web server processes spawning shells (bash, sh, zsh).
references:
 - https://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution
author: Security Arsenal
date: 2026/07/18
tags:
 - attack.execution
 - attack.t1059.004
 - attack.initial_access
 - attack.t1190
logsource:
 category: process_creation
 product: linux
detection:
 selection:
   ParentImage|endswith:
     - '/apache2'
     - '/httpd'
     - '/nginx'
     - '/php-fpm'
   Image|endswith:
     - '/bash'
     - '/sh'
     - '/zsh'
     - '/dash'
 condition: selection
falsepositives:
 - Legitimate administrative scripts executed by the web server (rare)
level: critical
---
title: WordPress wp2shell Exploit - Web Server Spawning Network Tools
id: b2c3d4e5-6789-01ab-cdef-234567890bcd
status: experimental
description: Detects potential exploitation of wp2shell by identifying web server processes spawning network utilities (curl, wget, nc) often used for callback or downloading malicious payloads.
references:
 - https://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution
author: Security Arsenal
date: 2026/07/18
tags:
 - attack.command_and_control
 - attack.t1105
 - attack.execution
 - attack.t1059.001
logsource:
 category: process_creation
 product: linux
detection:
 selection:
   ParentImage|endswith:
     - '/apache2'
     - '/httpd'
     - '/nginx'
     - '/php-fpm'
   Image|endswith:
     - '/curl'
     - '/wget'
     - '/nc'
     - '/ncat'
 condition: selection
falsepositives:
 - Legitimate plugin updates or API calls initiated by web hooks (verify user context)
level: high

KQL (Microsoft Sentinel / Defender)

This query hunts for the same behavior in DeviceProcessEvents (Microsoft Defender for Endpoint) or generic Syslog/CEF logs ingested into Sentinel. It focuses on the parent-child relationship indicative of a web application exploit.

// Hunt for web servers spawning suspicious processes (Indicative of wp2shell RCE)
DeviceProcessEvents
| where Timestamp > ago(3d)
| where InitiatingProcessFileName in ("apache2", "httpd", "nginx", "php-fpm", "httpd.worker")
| where FileName in ("sh", "bash", "zsh", "dash", "curl", "wget", "nc", "ncat", "python", "perl", "php")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

Velociraptor VQL

This artifact hunts for processes running under the context of the web user (www-data or apache) that look like shells or reconnaissance tools.

-- Hunt for suspicious processes spawned by web server users
SELECT Pid, Ppid, Name, Username, CommandLine, Exe
FROM pslist()
WHERE Username =~ 'www-data'
  OR Username =~ 'apache'
  OR Username =~ 'nginx'
AND Name =~ '(bash|sh|zsh|dash|curl|wget|nc|python|perl)'

Remediation Script (Bash)

Use this script to audit your WordPress installations for the vulnerable versions and verify the patch status.

#!/bin/bash
# wp2shell-audit.sh
# Checks for vulnerable WordPress versions (CVE-2026-63030 / CVE-2026-60137)

echo "[+] Starting WordPress Vulnerability Audit for wp2shell chain..."

# Define vulnerable versions based on current intel
VULN_RANGE_MAJOR="6.9|7.0"

# Find wp-includes/version.php files (common location for WP core)
# Adjust the search path /var/www/html as needed for your environment
find /var/www/html -name "version.php" -path "*/wp-includes/*" 2>/dev/null | while read file; do
    DIR=$(dirname "$file")
    WP_ROOT=$(dirname "$DIR")
    
    # Extract version
    VERSION=$(grep "\$wp_version" "$file" | awk -F "'" '{print $2}')
    
    if [ -z "$VERSION" ]; then
        continue
    fi

    # Check against vulnerable ranges 6.9.x and 7.0.x
    if echo "$VERSION" | grep -qE "^($VULN_RANGE_MAJOR)"; then
        echo "[!] VULNERABLE FOUND: $WP_ROOT is running WordPress $VERSION"
        echo "    Action Required: Patch immediately to the latest version."
    else
        echo "[-] OK: $WP_ROOT is running WordPress $VERSION"
    fi
done

echo "[+] Audit complete. If vulnerable instances were found, update WordPress Core immediately via the dashboard or WP-CLI."

Remediation

1. Immediate Patching: The only reliable remediation for the wp2shell chain is to update WordPress Core to the latest patched version.

• Patch Version: Update immediately to the latest security release (post-July 17, 2026). If you are on 6.9.x or 7.0.x, you are currently compromised.
• Action: Update via the WordPress Dashboard (Dashboard > Updates) or via command line: bash wp core update wp core update-db

2. Verify Integrity: After patching, verify the integrity of your WordPress core files using the wp core verify-checksums command to ensure no webshells were injected during the exploitation window.

3. Indicators of Compromise (IOCs) Sweep: If you were running a vulnerable version, assume compromise.

• Review access logs for suspicious POST requests to unknown endpoints or unusual User-Agents around the July 17 timeframe.
• Scan the webroot for recently modified PHP files: bash

    find /var/www/html -name "*.php" -mtime -7 -ls

4. Official Advisory: Refer to the official WordPress Security Release notes for the specific patched versions: https://wordpress.org/news/

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub