WordPress wp2shell Vulnerability Fuels Mass Scanning
Two critical security flaws combine to target WordPress sites globally.
1Critical Vulnerability in WordPress
Two critical vulnerabilities in WordPress, combined into an exploit chain called wp2shell, allow attackers to execute remote code without authentication and fully compromise websites. These flaws are tracked as CVE-2026-63030 and CVE-2026-60137.
2Global Impact
Attacks originate from IP addresses in Switzerland, Germany, the UK, Indonesia, Lithuania, the Netherlands, and Singapore. According to KEVIntel data, these IPs are linked to the wp2shell exploit. The attacks affect organizations of all sizes.
3Technical Details
The exploit chain leverages an authentication bypass in WordPress's REST API batch endpoint, allowing attackers to invoke internal handlers without permission. Additionally, improper sanitization of the 'author__not_in' parameter in 'WP_Query' contributes to the vulnerability.
4Post-Exploit Activities
Attackers upload malicious plugins, harvest user information, and perform local file inclusion (LFI) attacks. They also access the admin panel, authenticate themselves, and upload PHP web shells for remote code execution.
5Mass Scanning Campaigns
Wiz researchers detected high-volume scanning activities, likely opportunistic campaigns to identify vulnerable targets. A fake WordPress security plugin called CMSmap serves as a full-featured attack platform for attackers.
6Defense Recommendations
WordPress users should inspect their systems for new admin accounts, malicious plugins, and suspicious files. Even if systems are patched, these checks can help fully eliminate the threat.
Original article: The Hacker News — WordPress wp2shell Zafiyeti Kitlesel Taramalara Yol Açtı