CVE-2026-63030 & CVE-2026-60137: WordPress wp2shell Mass Exploitation — Defense and Detection Guide

The WordPress security landscape shifted dramatically this weekend as attackers began actively chaining two critical vulnerabilities, tracked as CVE-2026-63030 and CVE-2026-60137, in a campaign dubbed wp2shell. By the early hours of Saturday morning (UTC), telemetry confirmed that mass scanning had already evolved into successful exploitation, resulting in unauthenticated remote code execution (RCE) and complete server compromise.

For defenders, this is not a theoretical risk. The public availability of exploit code has lowered the barrier to entry for script kiddies and automated botnets alike. If you manage WordPress infrastructure, you are currently in an active race against automated scanners. This post provides the technical context required to understand the wp2shell attack chain and the defensive artifacts needed to detect and remediate it immediately.

Technical Analysis

The Vulnerability Chain

The wp2shell moniker refers to the specific chaining of two distinct flaws to achieve a critical impact:

1. CVE-2026-63030: This flaw serves as the initial entry point, likely involving an authentication bypass or an insecure direct object reference (IDOR) that allows unauthenticated interaction with a core component or plugin API.
2. CVE-2026-60137: This second vulnerability is the payload delivery mechanism. When chained with the first, it allows an attacker to inject and execute arbitrary code on the host system.

The Attack Vector

The attack sequence typically follows this pattern:

• Reconnaissance: Attackers scan the internet for WordPress instances, identifying vulnerable versions or configurations.
• Exploitation: The attacker sends a crafted HTTP request leveraging CVE-2026-63030 to bypass security controls. They then trigger CVE-2026-60137 to upload a webshell or execute a shell command via the web server context (e.g., www-data or nginx).
• Persistence: Once code execution is achieved, attackers often write a persistent webshell (e.g., shell.php, wp-log.php) to maintain access even if the initial vulnerability is patched.
• Objective: The compromised server is then used for cryptojacking, botnet recruitment (Mirai variants), or as a pivot point to attack internal networks.

Affected Platforms

• Platform: WordPress (Core)
• Impact: Unauthenticated RCE, Privilege Escalation (via kernel exploits if available), Server Compromise.
• Exploitation Status: CONFIRMED ACTIVE. Public exploits are available, and mass scanning is ongoing.

Detection & Response

Given the active exploitation of CVE-2026-63030 and CVE-2026-60137, SOC teams must deploy detection mechanisms immediately. Since these attacks result in RCE, the most reliable indicators are the web server spawning unexpected processes or the creation of suspicious PHP files.

Sigma Rules

These rules target the behavioral characteristics of the wp2shell exploitation chain: the web server process spawning a shell and the creation of new PHP files in writable directories.

---
title: WordPress wp2shell - Web Server Spawning Shell
id: a1b2c3d4-5678-90ab-cdef-123456789012
status: experimental
description: Detects potential exploitation of WordPress wp2shell (CVE-2026-63030) by identifying the web server process spawning a shell.
references:
 - https://thehackernews.com/2026/07/wordpress-wp2shell-exploitation-grows.html
author: Security Arsenal
date: 2026/07/12
tags:
 - attack.initial_access
 - attack.web_shell
 - attack.t1190
logsource:
 category: process_creation
 product: linux
detection:
 selection:
   ParentImage|endswith:
     - '/apache2'
     - '/httpd'
     - '/nginx'
     - '/php-fpm'
   Image|endswith:
     - '/sh'
     - '/bash'
     - '/nc'
     - '/perl'
     - '/python'
 condition: selection
falsepositives:
  - Legitimate administrative scripts executed by web interface
level: critical
---
title: WordPress wp2shell - Suspicious PHP File Creation
id: b2c3d4e5-6789-01ab-cdef-234567890123
status: experimental
description: Detects the creation of PHP files in common WordPress writable directories, indicative of webshell upload.
references:
 - https://thehackernews.com/2026/07/wordpress-wp2shell-exploitation-grows.html
author: Security Arsenal
date: 2026/07/12
tags:
 - attack.persistence
 - attack.web_shell
 - attack.t1505.003
logsource:
 category: file_creation
 product: linux
detection:
 selection:
   TargetFilename|contains:
     - '/wp-content/uploads/'
     - '/wp-content/plugins/'
   TargetFilename|endswith:
     - '.php'
 condition: selection
falsepositives:
  - Legitimate plugin updates or file uploads
level: high

Microsoft Sentinel / Defender KQL

Use this KQL query to hunt for successful exploitation attempts within your Syslog (CEF/Web logs) and process telemetry. It looks for the web server process launching unusual binaries.

// Hunt for web servers spawning shells (Linux EDR/Sysmon for Linux)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("apache2", "httpd", "nginx", "php-fpm")
| where FileName in~ ("sh", "bash", "dash", "perl", "python", "nc", "wget", "curl")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, CommandLine, ProcessId
| extend AlertDetail = "Potential wp2shell RCE detected"

// Hunt for webshell-like access patterns in Syslog/CEF (Web Server Logs)
Syslog
| where TimeGenerated > ago(24h)
| where Facility in ("nginx", "apache", "httpd")
| extend FilePath = extract(@'^.*"GET\s+(.*?)\s+HTTP', 1, SyslogMessage)
| extend StatusCode = extract(@'"\s+(\d+)\s+', 1, SyslogMessage)
| where StatusCode == "200"
| where FilePath has ".php" and (FilePath has "upload" or FilePath has "cache" or FilePath matches regex @"[a-f0-9]{32}")
| project TimeGenerated, Computer, ProcessName, FilePath, SyslogMessage
| extend AlertDetail = "Suspicious PHP file access potentially associated with wp2shell"

Velociraptor VQL

This Velociraptor artifact hunts for recently modified PHP files in web roots, which is a primary indicator of webshell deployment.

-- Hunt for recently modified PHP files in web roots indicating wp2shell activity
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs='/var/www/html/**/*.php')
WHERE Mtime > now() - 24 * 60 * 60
  OR Size < 5kb
  -- Common obfuscation indicators in filenames
  OR FullPath =~ 'config\.php' 
  OR FullPath =~ 'debug\.php'
ORDER BY Mtime DESC

Remediation Script (Bash)

Run this script on your WordPress servers to identify potential webshells created in the last 48 hours and check for specific process anomalies. Note: This script assumes a standard Linux environment.

#!/bin/bash

# Response script for CVE-2026-63030 / CVE-2026-60137 (wp2shell)
# Usage: sudo ./wp2shell_response.sh

echo "[*] Scanning for recently modified PHP files in web root..."

# Adjust path if your WordPress install is elsewhere
WEB_ROOT="/var/www/html"

# Find PHP files modified in the last 48 hours
find $WEB_ROOT -name "*.php" -mtime -2 -ls

echo "\n[*] Checking for active webshells (sh/bash spawned by www-data)..."

# Look for processes owned by www-data running shells
ps aux | grep -E '(www-data|nginx|apache)' | grep -E '(sh|bash|perl|python|nc)' | grep -v grep

echo "\n[*] Checking for listening reverse shells..."

# Look for established connections to high ports on common shells
ss -tulpen | grep ESTABLISHED | grep -E ':(4444|1337|31337|8888)'

echo "\n[!] ACTION REQUIRED: If suspicious files or processes are found, isolate the host immediately."
echo "[!] Apply patches for CVE-2026-63030 and CVE-2026-60137 immediately."

Remediation

Immediate action is required to secure your environment against the wp2shell exploitation campaign:

1. Patch Immediately: Apply the security updates released by the WordPress security team for CVE-2026-63030 and CVE-2026-60137. Ensure all WordPress instances are updated to the latest patched version immediately. If a patch is not yet available for your specific version, restrict access to /wp-admin/ and XML-RPC endpoints via WAF or IP allow-listing.

2. Assume Compromise: Due to the mass scanning activity active since Saturday, treat any vulnerable WordPress instance as compromised. Initiate a forensic review of logs, specifically looking for the POST requests associated with the exploit chain and the creation of new PHP files.

3. Web Application Firewall (WAF): Deploy signatures to block the exploit payloads for CVE-2026-63030. Major WAF vendors (Cloudflare, AWS WAF, ModSecurity) are releasing rules; ensure these are enabled immediately.

4. File Integrity Monitoring (FIM): Enable FIM on your web directories to alert on any new .php file creation. Since wp2shell drops a webshell, FIM is your last line of defense if the initial exploit bypasses the WAF.

5. Vendor Advisory: Consult the official WordPress Security Release for the specific version numbers and patch details: https://wordpress.org/news/

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub