wp2shell Pre-Auth RCE Chain (CVE-2026-63030 / CVE-2026-60137) Targeting WordPress Core: OTX Pulse Analysis — Enterprise Detection Pack

AlienVault OTX pulse data confirms active, in-the-wild exploitation of a critical pre-authentication remote code execution vulnerability chain in WordPress Core, dubbed "wp2shell" by Wiz researchers. The chain combines CVE-2026-63030 and CVE-2026-60137 to allow unauthenticated attackers to achieve full remote code execution on default WordPress installations — no plugins, no credentials, no user interaction required.

The attack chain, as reconstructed from the pulse tags and reference material, operates as follows:

1. SQL Injection (CVE-2026-60137): The attacker leverages a pre-authentication SQL injection flaw to manipulate WordPress's internal state — typically to forge or elevate session/nonce material or to poison options that downstream code trusts.
2. Batch API Exploitation (CVE-2026-63030): Weaponized requests to the WordPress REST batch API (/wp-json/wp/v2/batch) allow the attacker to chain privileged operations using the state established in step one, bypassing authentication checks on internal routes.
3. Arbitrary Plugin Upload → Webshell: With effective administrative capability, the attacker uploads a malicious plugin ZIP containing a PHP webshell, achieving persistent RCE as the web server user.

Multiple threat actors are already exploiting the chain, consistent with the classic post-disclosure pattern for WordPress criticals: within days, exploitation shifts from targeted intrusions to automated mass scanning and webshell droppers sold or shared across criminal forums. Because WordPress powers a substantial share of the public web, the exposed attack surface is enormous, and secondary payloads (stealers, miners, SEO spam injectors, ransomware staging) are expected to follow initial webshell deployment. The pulse associates the activity with CMSmap, an open-source CMS enumeration/exploitation toolkit — indicating that low-sophistication actors can weaponize this chain with commodity tooling.

Objective: Initial access at scale. Webshells planted via wp2shell are currency on dark web access markets — expect resold access, credential theft from wp-config.php (database creds, auth keys/salts), and follow-on payloads within days of compromise.

Threat Actor / Malware Profile

Attribution: Unknown / multiple actors (per OTX). The presence of CMSmap references and the TLP:WHITE public advisory pattern indicates this is currently a commodity exploitation wave rather than a single named APT — the threat is defined by the vulnerability chain, not the actor.

Tooling — wp2shell chain + CMSmap:

• Distribution method: Internet-wide scanning for WordPress instances, fingerprinting via CMSmap-style enumeration (/wp-json/ user enumeration, version disclosure, readme scans), followed by automated exploit delivery against the batch REST API endpoint.
• Payload behavior: The terminal payload is a PHP webshell dropped inside an uploaded "plugin" directory under wp-content/plugins/. Observed webshell families in comparable campaigns include WSO, b374k variants, and file-manager shells. The five SHA1 hashes in this pulse represent webshell/plugin artifacts recovered from exploited hosts.
• C2 communication: Webshells are not beaconing implants — they are tasked over inbound HTTP(S) POST requests to the shell URI, often with obfuscated payloads (base64, gzinflate, str_rot13 chains). Secondary implants (if dropped) may establish outbound C2 over HTTP/S or DNS; wp-config.php theft exfiltrates DB credentials for direct database access.
• Persistence mechanism: The malicious plugin registers itself in the active_plugins option in the wp_options table; shells may additionally drop copies into wp-content/uploads/, inject auto_prepend_file directives into .htaccess/.user.ini, or create rogue admin users in wp_users. Attackers frequently re-register vulnerable plugins/themes to maintain reinfection paths.
• Anti-analysis techniques: Obfuscated PHP (nested eval(gzinflate(base64_decode(...)))), timestamp manipulation to blend with legitimate plugin files, conditional execution keyed on specific User-Agent or password parameters, and log tampering where file permissions allow.

MITRE ATT&CK mapping (reconstructed): T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell), T1059 (Command and Scripting Interpreter), T1071.001 (Web Protocols), T1552.001 (Credentials In Files — wp-config.php), T1136 (Create Account — rogue WP admin).

IOC Analysis

The pulse contains 7 indicators across 2 types:

• 5 × FileHash-SHA1: Webshell and malicious-plugin artifacts recovered from exploited WordPress instances. These are point-in-time hashes — criminal repacking of PHP shells changes hashes rapidly, so treat them as retrospective hunt anchors, not a forward-looking blocklist. Sweep endpoint and web-server file telemetry (EDR, FIM, or file scans of wp-content/) for these hashes.
• 2 × CVE identifiers (CVE-2026-63030, CVE-2026-60137): The operational priority. These map directly to patch and exposure-management workflows: inventory every WordPress instance in your estate (including forgotten marketing microsites, dev/staging hosts, and container images), and verify remediation.

Operationalization guidance for SOC teams:

1. Load SHA1 indicators into your EDR/XDR blocklist and your FIM/AV custom signature sets. Also push them into your threat-intel platform (MISP, OpenCTI, Anomali) with the OTX pulse reference attached for context.
2. Translate the CVEs into attack-surface queries (EASM/CNAPP) and vulnerability-scanner templates — Nessus/Qualys/Nuclei templates for this chain are the fastest exposure check.
3. Behavioral detection is more durable than hashes for this threat: alert on the chain behavior — unauthenticated batch API requests followed by plugin-upload events, php-fpm/httpd spawning shells, and new files under wp-content/plugins/ outside deployment windows. YARA rules against common webshell eval-chains complement the hash sweep.
4. Tooling: oletools is not relevant here; for PHP shell triage use YARA + Loki/THOR scanners, php-malware-finder, and deobfuscation via php -r sandboxes or CyberChef for base64/gzinflate layers.

Detection Engineering

---
title: WordPress Batch API Exploitation Followed by Plugin Upload (wp2shell Chain)
id: 7f3a1c9e-4b2d-4e1a-9c6f-wp2shell0001
status: experimental
description: Detects the wp2shell attack pattern — unauthenticated requests to the WordPress REST batch endpoint correlated with subsequent plugin upload activity, matching CVE-2026-63030 / CVE-2026-60137 exploitation. Apply to web server / WAF / reverse proxy logs.
author: Security Arsenal Threat Intelligence
references:
  - https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137
date: 2026/08/23
logsource:
  category: webserver
detection:
  selection_batch:
    cs-uri-stem|contains: '/wp-json/wp/v2/batch'
    cs-method: 'POST'
  selection_upload:
    cs-uri-stem|contains:
      - '/wp-admin/update.php'
      - '/wp-json/wp/v2/plugins'
    cs-uri-query|contains:
      - 'action=upload-plugin'
      - 'install-plugin'
  condition: selection_batch or selection_upload
level: high
tags:
  - attack.t1190
  - attack.initial_access
  - cve.2026.63030
  - cve.2026.60137
---
title: Web Server Process Spawning Command Shell — Webshell Execution
id: 7f3a1c9e-4b2d-4e1a-9c6f-wp2shell0002
status: experimental
description: Detects PHP-FPM, Apache, Nginx, or IIS worker processes spawning command interpreters — consistent with webshell command execution following wp2shell plugin-upload compromise.
author: Security Arsenal Threat Intelligence
date: 2026/08/23
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\php-cgi.exe'
      - '\php.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\net.exe'
      - '\whoami.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
level: high
tags:
  - attack.t1505.003
  - attack.t1059
---
title: Suspicious File Creation in WordPress Content Directories
id: 7f3a1c9e-4b2d-4e1a-9c6f-wp2shell0003
status: experimental
description: Detects creation of PHP files in WordPress plugins/uploads directories by web server processes — a strong indicator of malicious plugin deployment or webshell drop via the wp2shell chain.
author: Security Arsenal Threat Intelligence
date: 2026/08/23
logsource:
  category: file_creation
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/wp-content/plugins/'
      - '/wp-content/uploads/'
      - '/wp-content/mu-plugins/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php5'
      - '.php7'
  filter_known_deployers:
    Image|endswith:
      - '/composer'
      - '/wp-cli'
  condition: selection_path and selection_ext and not filter_known_deployers
level: critical
tags:
  - attack.t1505.003
  - attack.persistence

// Hunt: wp2shell exploitation artifacts — webshell process execution + known-bad file hashes
// Microsoft Sentinel / Microsoft 365 Defender
let BadHashes = dynamic([
  "2a1410d8e2a8337ac2171cedea8c0fdc47c647a0",
  "58eca847e9eae9e6b08cc211f1559817b71bc4cc",
  "d9a220c8039f1c4d72cae7ccb8b3a33dec8815be",
  "e9756e2338f84746007235e4cab7a70d5b3ca47f",
  "ebea44890f434d5d67ede22009a3f4bb5cac33f8"
]);
let WebServerProcs = dynamic(["w3wp.exe", "httpd.exe", "php-cgi.exe", "php.exe", "php-fpm", "nginx"]);
let ShellProcs = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "/bin/sh", "/bin/bash", "net.exe", "whoami.exe", "curl", "wget", "certutil.exe"]);
union
(
  DeviceProcessEvents
  | where TimeGenerated > ago(14d)
  | where InitiatingProcessFileName in~ (WebServerProcs)
  | where FileName in~ (ShellProcs)
  | project HuntType="WebshellChildProcess", TimeGenerated, DeviceName,
      InitiatingProcessFileName, InitiatingProcessCommandLine,
      FileName, ProcessCommandLine, AccountName, ReportId
),
(
  DeviceFileEvents
  | where TimeGenerated > ago(14d)
  | where SHA1 in~ (BadHashes)
     or (FolderPath has_any ("wp-content/plugins", "wp-content/uploads", "wp-content\\plugins", "wp-content\\uploads")
         and FileName endswith ".php")
  | project HuntType="WebshellFileOrHash", TimeGenerated, DeviceName,
      FolderPath, FileName, SHA1, InitiatingProcessFileName, ReportId
),
(
  DeviceNetworkEvents
  | where TimeGenerated > ago(14d)
  | where InitiatingProcessFileName in~ (WebServerProcs)
  | where RemotePort in (80, 443, 4444, 8080)
    and RemoteIPType == "Public"
  | summarize ConnectionCount=count(), RemoteIPs=make_set(RemoteIP, 20)
      by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
  | where ConnectionCount > 25   // web processes rarely initiate high-volume outbound
  | project HuntType="WebServerOutboundC2", TimeGenerated, DeviceName,
      InitiatingProcessFileName, ConnectionCount, RemoteIPs
)
| sort by TimeGenerated desc

#!/usr/bin/env bash
# wp2shell IOC & artifact sweep — run on WordPress hosts (Linux)
# Checks: known-bad SHA1s, recent PHP writes in wp-content, rogue admin users,
# suspicious active_plugins entries, and web-process outbound connections.
set -u
WP_ROOT="${1:-/var/www/html}"
BAD_HASHES="2a1410d8e2a8337ac2171cedea8c0fdc47c647a0
58eca847e9eae9e6b08cc211f1559817b71bc4cc
d9a220c8039f1c4d72cae7ccb8b3a33dec8815be
e9756e2338f84746007235e4cab7a70d5b3ca47f
ebea44890f434d5d67ede22009a3f4bb5cac33f8"

echo "=== [1/5] SHA1 hash sweep of wp-content ==="
if [ -d "${WP_ROOT}/wp-content" ]; then
  find "${WP_ROOT}/wp-content" -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) -print0 2>/dev/null | \
  while IFS= read -r -d '' f; do
    h=$(sha1sum "$f" 2>/dev/null | awk '{print $1}')
    if echo "$BAD_HASHES" | grep -qx "$h"; then
      echo "[!!] KNOWN MALICIOUS HASH: $h  ->  $f"
    fi
  done
else
  echo "[-] wp-content not found under ${WP_ROOT}"
fi

echo "=== [2/5] PHP files modified in last 7 days under wp-content ==="
find "${WP_ROOT}/wp-content" -type f -name '*.php' -mtime -7 -printf '%TY-%Tm-%Td %TH:%TM  %p\n' 2>/dev/null | sort -r | head -50

echo "=== [3/5] Common webshell obfuscation markers ==="
grep -rEl --include='*.php' 'eval\s*\(\s*(gzinflate|base64_decode|str_rot13|gzuncompress)' "${WP_ROOT}/wp-content" 2>/dev/null | head -30

echo "=== [4/5] Rogue persistence: .user.ini / auto_prepend_file / htaccess tampering ==="
find "${WP_ROOT}" -name '.user.ini' -o -name '.htaccess' 2>/dev/null | xargs -r grep -l 'auto_prepend_file' 2>/dev/null

echo "=== [5/5] Outbound connections from web server processes ==="
ss -tnp 2>/dev/null | grep -Ei 'php-fpm|httpd|apache2|nginx' | grep -v ':80\|:443 ' | head -30

echo "=== DONE. Manually verify: wp_users for unknown admins, active_plugins option, and access logs for /wp-json/wp/v2/batch POSTs. ==="

Response Priorities

Immediate (0–4 hours):

• Patch or mitigate every WordPress instance against CVE-2026-63030 and CVE-2026-60137 — including staging, dev, and abandoned microsites. If patching is impossible, apply WAF/virtual-patch rules blocking unauthenticated POSTs to /wp-json/wp/v2/batch and plugin-upload actions.
• Block the five SHA1 hashes at EDR and gateway; run the hash sweep and KQL hunt across all web-facing hosts.
• Audit wp-content/plugins/, wp-content/uploads/, and wp_users for unauthorized additions on any host that was internet-exposed and unpatched since disclosure.

24 hours:

• Assume wp-config.php exposure on any confirmed-compromised host: rotate database credentials, WordPress auth keys/salts (invalidating all sessions), and any API keys stored in the database or environment.
• Force password resets for all WordPress administrator accounts; review for rogue admin creation and remove unauthorized active_plugins entries.
• Review egress: database servers accepting unexpected connections, and web hosts initiating outbound sessions (potential secondary C2).

1 week:

• Harden architecture: enable WordPress auto-updates for core, restrict REST API batch endpoint access by IP where feasible, deploy FIM on wp-content/, and segment web servers so they cannot reach internal networks or databases beyond their own schema.
• Enroll all WordPress infrastructure in continuous attack-surface monitoring; forgotten WP instances are the primary re-compromise vector for mass-exploitation waves like wp2shell.
• Deploy the Sigma rules above to your SIEM and validate end-to-end alerting with a controlled test of the batch-endpoint pattern.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub