WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning
Two critical vulnerabilities in WordPress, CVE-2026-63030 and CVE-2026-60137 (codenamed wp2shell), enable unauthenticated remote code execution (RCE) through a chained exploit involving route confusion and improper input sanitization. The exploit chain was discovered using OpenAI GPT 5.6 Sol, highlighting how AI-assisted analysis significantly lowers the technical barrier for creating proof-of-concept exploits and accelerating vulnerability discovery. Post-exploitation activities include uploadi
Analysis
TL;DR
- Two critical vulnerabilities in WordPress, CVE-2026-63030 and CVE-2026-60137 (codenamed wp2shell), enable unauthenticated remote code execution (RCE) through a chained exploit involving route confusion and improper input sanitization.
- The exploit chain was discovered using OpenAI GPT 5.6 Sol, highlighting how AI-assisted analysis significantly lowers the technical barrier for creating proof-of-concept exploits and accelerating vulnerability discovery.
- Post-exploitation activities include uploading malicious plugins, creating backdoor administrator accounts, executing local file inclusion attacks, and deploying advanced malware such as the Overlord RAT and a disguised CMSmap web shell.
- Initial telemetry indicates widespread impact, with 60% of WordPress-using organizations having at least one vulnerable instance at publication, though automatic updates and virtual patches have helped reduce the exposure window.
Why It Matters
This incident demonstrates the accelerating pace of vulnerability discovery and exploitation driven by AI tools, posing a significant risk to organizations relying on standard WordPress installations. It underscores the critical importance of maintaining up-to-date security patches and monitoring for anomalous administrative activities, even after applying fixes, to ensure complete remediation of potential backdoors.
Technical Details
- Vulnerability Chain: CVE-2026-60137 is a route confusion bug in the REST API batch endpoint that bypasses authentication, serving as the entry point for unauthenticated SQL injection. CVE-2026-63030 leverages improper sanitization of the 'author__not_in' parameter in 'WP_Query' to achieve remote code execution, particularly when persistent object cache is not in use.
- AI-Assisted Discovery: Searchlight Cyber utilized OpenAI GPT 5.6 Sol to identify and chain these vulnerabilities over a 10-hour period, demonstrating the efficacy of AI in analyzing complex codebases and identifying subtle logic flaws.
- Affected Versions: The SQL injection vulnerability affects WordPress versions 6.8 and later, while the RCE component impacts versions 6.9 and later. The exploit requires no plugins or preconditions, affecting stock installations.
- Exploit Techniques: Attackers employed various SQL injection methods, including blind, UNION-based, and Boolean-based payloads. Post-exploitation tactics involved uploading a 150 KB web shell disguised as a security plugin and attempting to install the Overlord RAT.
Industry Insight
- AI in Cybersecurity: Security teams must account for AI-augmented threat actors who can rapidly develop exploits from public vulnerability details. Defensive strategies should incorporate AI-driven anomaly detection to identify sophisticated, automated attack patterns.
- Proactive Remediation: Organizations should implement rigorous patch management protocols and verify the integrity of their WordPress installations by auditing for unauthorized admin accounts and suspicious files, rather than relying solely on automatic updates.
- Supply Chain Vigilance: Given the use of disguised malicious plugins and web shells, continuous monitoring of installed extensions and file integrity is essential to detect and mitigate post-compromise activities effectively.
Disclaimer: The above content is generated by AI and is for reference only.