# WordPress wp2shell Vulnerability Fuels Mass Scanning Two critical security flaws combine to target WordPress sites globally. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-21 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/57dbf636-1e81-4e30-9e27-d1473674daf2 ## Critical Vulnerability in WordPress Two critical vulnerabilities in WordPress, combined into an exploit chain called wp2shell, allow attackers to execute remote code without authentication and fully compromise websites. These flaws are tracked as CVE-2026-63030 and CVE-2026-60137. ## Global Impact Attacks originate from IP addresses in Switzerland, Germany, the UK, Indonesia, Lithuania, the Netherlands, and Singapore. According to KEVIntel data, these IPs are linked to the wp2shell exploit. The attacks affect organizations of all sizes. ## Technical Details The exploit chain leverages an authentication bypass in WordPress's REST API batch endpoint, allowing attackers to invoke internal handlers without permission. Additionally, improper sanitization of the 'author__not_in' parameter in 'WP_Query' contributes to the vulnerability. ## Post-Exploit Activities Attackers upload malicious plugins, harvest user information, and perform local file inclusion (LFI) attacks. They also access the admin panel, authenticate themselves, and upload PHP web shells for remote code execution. ## Mass Scanning Campaigns Wiz researchers detected high-volume scanning activities, likely opportunistic campaigns to identify vulnerable targets. A fake WordPress security plugin called CMSmap serves as a full-featured attack platform for attackers. ## Defense Recommendations WordPress users should inspect their systems for new admin accounts, malicious plugins, and suspicious files. Even if systems are patched, these checks can help fully eliminate the threat. ## Sources covering this story - https://thehackernews.com/2026/07/wordpress-wp2shell-exploitation-grows.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._