🕵️ wp2shell

The items that name it 7

• Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms
  writeupas classification.key entities2026-09-18
• [tl;dr sec] #341 - Hugging Face Incident Black Hat Talk, CSS Bomb in your Inbox, GitHub Supply Chain Security Improvements
  articleas threat actors2026-08-13It is written here as wp2shell (pre-authentication RCE chain in WordPress core, exploited in the wild per Wiz).

  pre-authentication RCE chain in WordPress core, exploited in the wild per Wiz

• Agentless Threat Detection: Illuminating Cloud Blind Spots
  articleas threat actors2026-07-21

  Exploitation chain/webshell campaign targeting WordPress Core via pre-auth RCE, deploying a PHP webshell that registers a custom REST API endpoint (/morning/v1/[REDACTED]) with permissive callback ('__return_true') to execute base64-encoded commands

• wp2shell CVE-2026-63030: The WordPress RCE Putting 500+ Million Sites at Risk
  articleas threat actors2026-07-21It is written here as wp2shell (name of the vulnerability chain combining CVE-2026-63030 and CVE-2026-60137; no in-the-wild exploitation confirmed as of the most recent reporting).

  name of the vulnerability chain combining CVE-2026-63030 and CVE-2026-60137; no in-the-wild exploitation confirmed as of the most recent reporting

• Exploitation in the Wild of wp2shell
  writeupas classification.key entities2026-07-20
• Unauthenticated RCE in WordPress core (wp2shell), via SQL injection
  writeupas classification.key entities2026-07-17
• Icex0/wp2shell-poc
  repoas classification.key entities2026-07-17