WordPress wp2shell: In-the-Wild RCE Within 24 Hours of…

The wp2shell vulnerability chain in WordPress Core is under active in-the-wild exploitation with pre-authentication RCE. Wiz Research documents sophisticated webshells, malicious plugins, and mass scanning within 24 hours of disclosure.

The wp2shell vulnerability, discovered by Searchlight Cyber with support from OpenAI GPT 5.6 Sol and published July 17, 2026, is actively exploited in-the-wild against self-hosted WordPress installations in the cloud. Wiz Research documented near-immediate exploitation: sophisticated webshells, malicious plugins, and mass scanning within 24 hours of disclosure. The case marks a turning point in the relationship between AI-assisted discovery and weaponization by threat actors.

Key Takeaways

CVE-2026-63030 (CVSS 9.8 CRITICAL) and CVE-2026-60137 (CVSS 5.9 MEDIUM) form a pre-authentication RCE chain in WordPress Core, dubbed wp2shell
The core mechanism is "batch-route confusion" in the REST API: the /wp-json/batch/v1 endpoint separates validation from execution, allowing SQL injection with escalation to admin privileges
Wiz Research observed active exploitation with 150KB webshells disguised as CMSmap plugins, specific user agents, and malicious plugin uploads against cloud instances
WordPress.org released versions 7.0.2, 6.9.5, and 6.8.6 with fixes and enabled forced updates via auto-update: the 60% of vulnerable organizations dropped to 50% in 24 hours

"We've observed multiple actors successfully exploiting this vulnerability chain against WordPress instances self-hosted in the cloud" — Wiz Research

The Mechanism: How the Batch API Betrays Validation

The technical core lies in the behavior of the WordPress REST API's /wp-json/batch/v1 endpoint. The batch architecture processes multiple requests in parallel but separates the parameter validation phase from the execution phase. This "batch-route confusion" allows bypassing the has_valid_params() function on individual requests within the batch.

Once past the check, the attacker injects SQL code that leads to privilege escalation to administrative privileges. With admin access, RCE is achievable through malicious plugin upload or Local File Inclusion on the wp-config file. The chain is pre-authenticated on WordPress installations with default configuration, according to Wiz Research and confirmed by the official WordPress.org advisory.

The cited source does not specify whether variants of the mechanism can bypass configurations with the REST API disabled or endpoint hardening. The dossier also does not document the existence of bypasses for the released patches.

The Discovery: AI as a Vulnerability Research Amplifier

Searchlight Cyber conducted the research using OpenAI GPT 5.6 Sol, a specialized reasoning model. The AI-assisted methodology did not replace the human researcher — Adam Kues of Assetnote/Searchlight Cyber is credited as the official reporter — but compressed code analysis and bypass pattern identification timelines.

This aspect raises a structural question for the industry. If discovery of a pre-authentication RCE chain in software with roughly 500 million instances worldwide can be accelerated by language models, the temporal gap between public disclosure and weaponization narrows measurably. In the wp2shell case, the compression went beyond theory: exploit POCs appeared "almost immediately," according to Wiz Research.

In-the-Wild Exploitation: Webshells, IoCs, and Post-Exploitation

Wiz Research observed multiple actors, not attributed to specific groups, engaged in active exploitation against self-hosted cloud instances. Documented post-exploitation includes: malicious plugin upload, user enumeration, LFI on wp-config, and admin panel access.

Detected payloads include three classes of webshells. The first is a minimal one-liner that returns HTTP 404 to evade superficial detection. The second is a 150KB webshell disguised as a "CMSmap" plugin, with a graphical interface, password authentication, file management, database access, port scanning, batch code injection, and privilege escalation modules. The CMSmap name impersonates a legitimate WordPress auditing project. The third implements a custom REST API endpoint /morning/v1/.

Observed indicators of compromise include HTTP 207/200 responses to batch endpoints and user agents containing the strings "wp2shell" and "rezwp2shell." These patterns, according to Wiz Research, serve as "reliable tool signatures identifying purpose-built exploitation frameworks."

The brief does not document whether the observed webshells correlate with pre-existing threat campaigns or represent original tools developed for this vulnerability.

Why It Matters

The source does not specify operational mitigations beyond software updates. The dossier does not document recommendations on Web Application Firewalls, network segmentation, or REST API hardening for instances that cannot be updated immediately.

The brief also does not indicate whether the observed webshells led to lateral movement or data exfiltration: Wiz Research explicitly states it has not identified such activity at this time. The nature of data potentially exposed via LFI on wp-config is not detailed by the source.

The identity of the actors remains undetermined: "multiple actors" without documented infrastructure overlaps linking the activity to known groups. The motive — widespread opportunism versus targeted interest — is not stated textually.

WordPress.org Response: Patches and Forced Auto-Update

WordPress.org released versions 7.0.2, 6.9.5, and 6.8.6 correcting the vulnerability. The official advisory confirms the same technical nature — "REST API batch-route confusion and SQL injection issue leading to Remote Code Execution" — and credits Adam Kues at Assetnote/Searchlight Cyber.

The auto-update system enabled forced updates. At the time of vulnerability publication, roughly 60% of organizations with WordPress instances had at least one vulnerable installation, and 25% had servers directly exposed to the Internet. Within 24 hours, those percentages dropped to 50% and 10% respectively, according to Wiz Research. This data indicates a deployment velocity above the historical average for WordPress, likely driven by the vulnerability's severity and vendor automation.

The official WordPress.org advisory also mentions a facilitated SQL injection vulnerability, reported by TF1T, dtro, and haongo, distinct from the wp2shell chain. The dossier does not clarify whether this second flaw has been exploited in-the-wild or remained theoretical.

The exact publication date of the WordPress.org advisory is not captured in the provided text; the brief does not document it.

What Changes in the Discovery-to-Exploitation Cycle

The wp2shell case provides an empirical measure of how AI-assisted discovery is modifying the geometry of offensive security. This is not the first vulnerability found with language model support, but it is the first documented case where the AI-assisted discovery → publication → in-the-wild weaponization chain completes in roughly 24 hours on an attack surface of half a billion instances.

For organizations managing self-hosted WordPress, the shifting parameter is not just the severity of the single flaw, but the predictability of the time available. If the window between disclosure and active exploitation measures in hours rather than days, reactive patching becomes insufficient by definition. The cited source does not specify which defensive architectures — if any — withstood active exploitation, nor does it recommend preventive configurations outside of automatic updates.

The dossier also does not document whether cloud-managed instances (managed WordPress) suffered parallel exploitation compared to self-hosted installations, or whether the self-hosted surface was strategically selected by the observed actors.

Questions and Answers

Which WordPress versions are actually vulnerable?

According to Wiz Research: 6.8.0-6.8.5, 6.9.0-6.9.4, 7.0.0-7.0.1. WordPress.org confirms the release of patches 7.0.2, 6.9.5, and 6.8.6.

Does exploitation require specific conditions?

The chain works on default WordPress installations with the REST API active. The brief does not specify whether configurations with the REST API disabled or endpoint hardening plugins proved effective barriers.

Who developed the observed webshells?

Wiz Research does not attribute the payloads to identified groups. The dossier does not document correlations between the webshells and previous threat campaigns.

Information is based on the cited source and current as of publication.

Sources

Sources and references