wp2shell: 45 Million Exploit Attempts in 7 Days — Vulnerability…

The wp2shell campaign generated 45 million exploit attempts in one week. The data proves traditional vulnerability management is no longer fit for purpose.

On July 17, 2026 — the very day the WordPress vulnerabilities CVE-2026-60137 and CVE-2026-63030 were publicly disclosed — attackers were already striking. Within seven days, exploit attempts topped 45 million from nearly 150,000 unique network sources, according to converging analyses from Wordfence, Wiz, and Bitdefender. The stakes are no longer the severity of a single CVE, but the speed at which mass automation has compressed the window between disclosure and compromise to mere hours.

Key Takeaways

Over 45 million exploit attempts in the first week post-disclosure — roughly 20 times the scale of Drupalgeddon
Attackers began striking on July 17, 2026, the day of disclosure, with mass exploitation starting July 18
The chain combines CVE-2026-60137 (SQL injection, CVSS 5.9) and CVE-2026-63030 (REST API batch route confusion, CVSS 9.8)
60% of cloud WordPress organizations had at least one vulnerable instance at publication; within 24 hours those figures dropped to 50% and 10%

The Scale of Automation: 45 Million Attempts and No Targeting

The campaign reached an unprecedented scale for WordPress targeting. The Wordfence Firewall blocked over 11 million exploit attempts, but that figure covers only Premium users and represents a partial estimate of total volume. CyberSecurityNews data indicates the campaign exceeded 45 million attempts in the first week, a multiplication of roughly 20x over Drupalgeddon.

A distinctive element emerges from the indiscriminate nature of the scanning: attackers also hit Drupal environments with WordPress-specific URL patterns, demonstrating a complete absence of targeted reconnaissance. The attack economics follow a "spray wide, then identify what worked" paradigm that inverts the traditional model of pre-identifying targets.

The Technical Chain: From SQL Injection to Full RCE

The wp2shell vulnerability is built as a chain of two distinct flaws. CVE-2026-60137 is an unauthenticated SQL injection that, in isolation, carries a CVSS 5.9 MEDIUM score per the official CVE.org record. The second component, CVE-2026-63030, exploits a routing confusion in WordPress REST API batch endpoints. The combination yields a chain rated CVSS 9.8 CRITICAL, per Bitdefender analysis.

Wordfence documented both vulnerabilities with specific parameters and endpoints, confirming the chain's technical structure. Bitdefender MDR observed a repeated operational pattern: the attack chain executed three times before full success, leaving orphaned administrator accounts with the 'w2s_' prefix even in cases of partial compromise.

This pattern has a concrete investigative consequence. As Bitdefender reports, "An orphaned w2s_-prefixed account on a server with no visible webshell is a confirmation that the server was targeted, the chain ran at least partway, and the attacker may return." The orphaned account is not a failed attempt to ignore; it is an indicator the attacker can come back.

The Compressed Response Window: Hours, Not Days

The exploitation timeline highlights the speed of compression. Disclosure occurred July 17, 2026. Attackers began striking the same day, with "only a small number of probing attempts on that first day," per Wordfence. Mass exploitation began July 18. CISA added both CVEs to the KEV catalog on July 21, 2026, before public PoC availability. The full PoC was published July 22, 2026 by Icex0.

Wiz Research data on the cloud sample shows the velocity of exposure and reaction: at publication, 60% of cloud WordPress organizations had at least one vulnerable instance, and 25% exposed a vulnerable server to the internet. Within 24 hours, those percentages had fallen to 50% and 10% respectively. The trend indicates a significant portion of organizations reacted quickly, but the maneuvering room was extremely narrow.

"Security teams must throw away vulnerability-management processes built around days or weeks of assessment and remediation. That timeline is no longer accurate. They now need to prepare for a response window increasingly measured in just hours." — Joey Stanford, CISO Pantheon

AI-Assisted Discovery and the Limits of the Narrative

The vulnerability was discovered by Searchlight Cyber using OpenAI GPT 5.6 Sol, according to Wiz. However, converging sources specify that AI is not solely responsible for the attack's magnitude: pre-existing automation and the economics of wide-scale attacks play a decisive role. Not every future CMS vulnerability will generate tens of millions of attempts, as the analyses note, but the compression of the response window is a trend independent of any single campaign.

Wiz stated it did not identify lateral movement or data exfiltration in monitored environments. This limit means documented post-exploitation stops at administrator account creation and installation of malicious plugins with PHP webshells. Absence of evidence does not rule out other scenarios, but the dossier does not document subsequent movements.

Immediate Actions

Operational actions follow directly from the source data. The priority is verifying the presence of administrator accounts with the 'w2s_' prefix in WordPress logs: even orphaned accounts with no visible webshell indicate active targeting and possible attacker return. Verification of patches for both CVEs must be immediate for internet-exposed instances, given that 25% of cloud organizations were vulnerable at disclosure.

Containment architecture becomes critical as a compensatory layer: WAF and segmentation do not replace patching, but they buy time during the compressed response window. Monitoring for repeated attempts is essential: Bitdefender documented that the chain executed three times before full success, leaving investigable traces.

For organizations with cloud WordPress instances, exposure verification must include checking REST API batch routing, the specific vector for CVE-2026-63030. The explicit recommendation from sources is clear: defense layers complement patching; they do not substitute for it.

The Breaking Point of Vulnerability Management

The wp2shell numbers are not anecdotal. When 45 million attempts arrive in seven days from 150,000 different sources, the question is not how severe a single CVE is, but how much time remains before automation finds an unpatched instance. The CVSS 5.9 of CVE-2026-60137, read in isolation, understates the real risk: the full chain carries CVSS 9.8, and the speed of exploitation has rendered nominal severity irrelevant for operational management.

The wp2shell case marks a turning point: a response window measured in hours is no longer an exception, but the design parameter for vulnerability management. Organizations that calibrate processes on days or weeks operate on a timescale that mass automation has already made obsolete.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references