The wp2shell Crisis: AI Cybersecurity Threats Targeting WordPress Core at Scale
Hackers are actively weaponizing a pair of critical vulnerabilities in WordPress Core to plant persistent backdoors across the web's most popular content management system. The exploit chain, dubbed "wp2shell" by researchers, chains two flaws—CVE-2026-63030 and CVE-2026-60137—to achieve unauthenticated remote code execution on vulnerable installations.
This isn't theoretical. Within hours of WordPress releasing patches, threat actors were already scanning for unpatched sites, uploading malicious plugins disguised as legitimate add-ons, and deploying PHP webshells that give them full command-line access to compromised servers.
The broader implication for AI cybersecurity threats is stark: researcher Adam Kues at Assetnote/ Searchlight Cyber publicly documented using AI tools to develop the working exploit chain. When attackers can leverage artificial intelligence to accelerate vulnerability research and weaponization, the window between disclosure and mass exploitation shrinks dramatically.
WordPress addressed the issues in versions 7.0.2, 6.9.5, and 6.8.6, forcing automatic security updates for supported installations. But with only an 81.6% patch rate across a sample of 124,580 sites as of late July 2026, roughly one in five WordPress installations remains exposed.
Anatomy of the wp2shell Exploit Chain
The wp2shell vulnerability suite is elegant in its simplicity, which makes it dangerous. Two separate flaws in WordPress Core combine to create a path from unauthenticated HTTP request to full remote code execution.
CVE-2026-63030 is a REST API batch endpoint route confusion issue affecting WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2. The WordPress REST API includes a batch-processing feature that lets clients bundle multiple requests into a single call. Researchers discovered that this endpoint could be manipulated to bypass normal routing logic, essentially tricking WordPress into executing operations it shouldn't allow.
CVE-2026-60137 is a SQL injection vulnerability in the author__not_in parameter of WP_Query. When plugins or themes pass untrusted user input directly to this parameter without proper sanitization, attackers can inject arbitrary SQL commands. This one alone scores a 5.9 CVSS (Medium) from WPScan, but CISA-ADP bumped it to 9.1 Critical because of its real-world exploitability.
Alone, each flaw is manageable. Together, they're catastrophic. The REST API route confusion (CVE-2026-63030) provides the delivery mechanism, while the SQL injection (CVE-2026-60137) provides the execution path. Combined, they allow an unauthenticated attacker to run arbitrary code on the server.
CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on July 21, 2026, under BOD 22-01. The SSVC assessment marks both as actively exploited and automatable, with total technical impact—meaning attackers don't need to be particularly skilled or lucky to weaponize them.
What Attackers Are Actually Doing in the Wild
Cloud security firm Wiz has shared detailed observations of active wp2shell exploitation campaigns. Their findings paint a picture of methodical, multi-stage attacks:
Mass scanning and enumeration. Attackers are systematically probing for vulnerable WordPress installations, with much of the initial traffic coming from security scanners being repurposed for malicious ends.
Malicious plugin deployment. Once a vulnerable site is identified, actors abuse WordPress's plugin upload functionality to install malicious add-ons. These range from simple one-liner PHP backdoors to feature-rich, obfuscated shells disguised as legitimate plugins—CMSmap being one documented example.
Credential harvesting. Attackers query the WordPress REST API to collect administrator usernames and email addresses. They're also attempting Local File Inclusion attacks targeting wp-config.php through admin-ajax.php to extract database credentials and authentication keys.
Persistent access. A malicious plugin exposing a REST API endpoint for remote command execution has been observed, giving attackers a clean, persistent backdoor that survives plugin updates and is harder to detect than a stray PHP file.
Wiz notes it hasn't observed lateral movement or data exfiltration yet, but continues monitoring closely. The fact that attackers are building sophisticated tooling suggests this is early-stage infrastructure building, not random opportunistic scanning.
The Two-Stage Attack Pattern from SANS
Johannes B. Ullrich, Dean of Research at the SANS Technology Institute, documented a particularly clever two-stage attack pattern that's worth understanding for detection purposes.
The first stage is reconnaissance: attackers probe for the SQL injection vulnerability to confirm the site is vulnerable before attempting exploitation. This minimizes noise and reduces the chance of triggering alarms on non-vulnerable targets.
The second stage is webshell deployment. Ullrich published the actual webshell code being used, which drops a PHP file into the /wp-content/cache/ directory with a randomized filename. Here's where it gets clever: that same random filename serves as the password, accessed via a URL variable. If you don't know the filename, the shell returns a fake 404 page—making it nearly invisible to casual inspection.
The webshell checks for the availability of several PHP execution functions—system(), passthru(), exec(), shell_exec(), popen(), and the backtick operator—then uses whichever is available to execute command payloads. Some attacks also create rogue administrator accounts for additional persistent access.
Ullrich recommends checking the /cache/ directory and reviewing user lists for newly created admin accounts as part of any wp2shell incident response.
How AI Accelerated the wp2shell Exploit Development
Perhaps the most significant aspect of this vulnerability for AI cybersecurity threats is how Adam Kues at Assetnote/Searchlight Cyber developed the working exploit chain. In a follow-up report, Kues detailed using AI tools throughout the discovery and exploitation development process.
This isn't a minor detail. When threat actors can leverage artificial intelligence to analyze code, identify vulnerable patterns, and construct working exploits, the traditional timeline of vulnerability research compresses dramatically. What might have taken a skilled researcher weeks can now be accelerated significantly with AI assistance.
The wp2shell chain required understanding the REST API batch endpoint's routing logic and identifying how to manipulate it to trigger the SQL injection path. Both tasks—code analysis and exploit construction—are areas where AI tools provide genuine assistance to attackers.
This pattern is likely to repeat. As AI coding assistants become more capable, we should expect to see similar accelerations across vulnerability research, exploit development, and malware creation. The wp2shell case is an early, well-documented example of this trend in action.
Patch Status and Immediate Response Steps
WordPress released security updates on July 17, 2026: version 7.0.2 for the current release line, 6.9.5 for the 6.9 branch (fixing both vulnerabilities), and 6.8.6 for the 6.8 branch (fixing only the SQL injection). Versions prior to 6.8 are not affected by either vulnerability.
Due to the severity, WordPress enabled forced updates via its automatic update system. Sites running affected versions should have updated automatically, but verification is essential.
Macnica researcher Yutaka Sejiyama created a live tracking dashboard that reports an 81.6% patch rate across 124,580 evaluated WordPress sites as of late July 2026. That means roughly 18.4%—about 22,900 sites in his sample—remain unpatched and exposed.
Immediate response steps for WordPress administrators:
- Verify your site is running WordPress 7.0.2, 6.9.5, or 6.8.6 (or later)
- Review server logs for wp2shell-related requests, particularly REST API
/batch/v1endpoint calls - Inspect installed plugins for anything unrecognized or suspicious
- Check the
/wp-content/cache/directory for newly created PHP files with random names - Review the WordPress user list for rogue administrator accounts
- Consider implementing WAF rules to block REST API
/batch/v1endpoint access as a temporary mitigation - Monitor for SQL injection attempts in your web server logs