Exploitation in the Wild of wp2shell

What it is

Active in-the-wild exploitation of "wp2shell" (CVE-2026-63030 & CVE-2026-60137), a pre-auth RCE chain in WordPress Core affecting any version released since December 2025. Wiz Research observed multiple actors exploiting self-hosted cloud WordPress instances following the chain's July 17, 2026 publication. This document carries the specifics the summary omits: the exposure numbers, the exact exploitation URLs, and the mitigation constraint.

Prevalence and trajectory

At publication, 60% of organizations using WordPress had at least one vulnerable instance, and 25% exposed a vulnerable server to the Internet. Within 24 hours those dropped to 50% and 10% respectively as patching began — a fast-moving window, so the exposure question is time-sensitive.

How the attack plays out

The chain abuses the WordPress REST API batch endpoint, reachable as either /wp-json/batch/v1 or /?rest_route=/batch/v1, for unauthenticated code execution. Post-exploitation activity Wiz observed:

• Plugin upload for persistence: attackers hit /wp-admin/plugin-install.php?tab=upload then POST /wp-admin/update.php?action=upload-plugin to install backdoors.
• User enumeration: GET /wp-json/wp/v2/users?context=edit to harvest admin usernames/emails.
• LFI: admin-ajax.php?template=../../../wp-config targeting DB credentials and auth keys.

Note the POC evolution: early public POCs were limited to SQL injection on default configs (RCE only under specific conditions); later POCs achieved RCE against arbitrary targets — so the threat escalated after initial disclosure.

Three payloads were seen: a minimal one-liner backdoor that returns 404 as evasion; a 150KB webshell disguised as the "CMSmap" plugin (obfuscated via eval(gzuncompress(base64_decode(...))), with file management, DB access, port scanning, and privilege escalation including MySQL UDF exploitation); and a plugin registering a custom REST endpoint (/morning/v1/[REDACTED]) with a permissive __return_true callback that decodes and executes base64 commands.

What to do

Patch. If you cannot, block the batch endpoint — both /wp-json/batch/v1 and ?rest_route=/batch/v1 — at a WAF, or disable anonymous REST API access via plugin.

Detection: HTTP 207/200 Multi-Status responses to batch endpoint requests are described as a high-fidelity indicator of successful exploitation (corroborated by Hexastrike); user-agent strings containing wp2shell and rezwp2shell are reliable tool signatures.

Caveats

The 207/200 response signal is high-fidelity but not exclusive — high-volume opportunistic scanning and legitimate security scanners generate batch traffic too. Wiz's own IOC list had a false positive (45.79.167[.]238, a legitimate scanner, removed 2026-07-22), so validate IOCs before acting. No lateral movement or data exfiltration had been identified at time of writing.