wp2shell: Unauthenticated RCE on Vanilla WP 6.9/7.0 — Patching Now?
Just caught the update on the wp2shell situation, and this looks like a nightmare for anyone managing a large WordPress estate. The fact that this is a core vulnerability affecting bare installs (no plugins required) is bad enough, but the added complexity of the persistent-object-cache condition makes mitigation tricky.
For those who missed it, the flaws (CVE-2026-3051 and CVE-2026-3052) allow an unauthenticated attacker to execute code via a specially crafted HTTP request. If you are running object caching (Redis/Memcached), the persistence mechanism in the PoC is particularly nasty.
I've started scanning our internal ranges, but detection is difficult because the request looks like standard traffic until the deserialization happens. I'm currently throwing this rule at our WAFs to catch the probing attempts:
apache SecRule ARGS "@rx ^WP_COOKIE" \ "id:100098,phase:2,deny,status:403,msg:'wp2shell exploitation attempt',logdata:'Matched Data: %{MATCHED_VAR} within %{ARGS_NAME}'"
Has anyone successfully implemented a reliable log-based detection rule for this yet? Or is everyone just rushing to force-update to the latest patched versions? Given the PoC is public, I'm assuming active exploitation is imminent.
We started seeing probes hitting our honeypots about an hour ago. The requests are targeting wp-admin/admin-ajax.php with a specific payload length. If you can't patch immediately, I recommend blocking access to that endpoint for unauthenticated IPs temporarily:
nginx
location * /wp-admin/admin-ajax.php {
if ($http_cookie !* "wordpress_logged_in_*") {
return 403;
}
try_files $uri $uri/ /index.php?$args;
}
It's a blunt instrument, but it stops the RCE until you can update.
From a pentest perspective, this is incredibly smooth. The cache poisoning aspect means even if you patch, the payload might linger in Redis if you don't flush the cache. Make sure you restart your caching service after the update!
# Don't forget to flush cache or restart Redis
redis-cli FLUSHALL
Otherwise, you might still be vulnerable to the persistence mechanism even on the patched version.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access