Critical Vulnerabilities in WordPress Core Exploited to Achieve Unauthenticated Remote Code Execution Globally.

Cybersecurity researchers have identified a devastating exploit chain targeting the core architecture of WordPress, the world’s most widely used content management system. Labeled "wp2shell," the attack sequence leverages two critical security flaws to grant unauthenticated attackers the ability to execute arbitrary code and seize total control of affected websites. The vulnerabilities, tracked as CVE-2026-63030 and CVE-2026-60137, represent one of the most significant threats to the WordPress ecosystem in recent years due to their lack of preconditions and their presence in default installations.

The exploit chain was first identified by Searchlight Cyber, which utilized the advanced reasoning capabilities of OpenAI’s GPT 5.6 Sol to uncover the flaws within a ten-hour research window. The discovery highlights a paradigm shift in vulnerability research, where high-level artificial intelligence is being used to synthesize complex exploit paths that might otherwise remain hidden for years. According to the initial findings, the wp2shell exploit affects every version of WordPress released since December 2025, placing millions of websites at immediate risk.

Technical Anatomy of the wp2shell Exploit Chain

The wp2shell attack is a sophisticated two-part sequence that begins with a bypass of standard security protocols and ends with full system compromise. The primary entry point is CVE-2026-60137, a route confusion vulnerability located within the WordPress REST API’s batch endpoint. This specific flaw allows an unauthenticated user to craft a single HTTP request that misleads the system’s internal routing logic. By exploiting this confusion, an attacker can invoke internal handlers and administrative functions that are typically protected by authentication layers.

Once the attacker has bypassed the initial authentication check, they leverage CVE-2026-63030, a critical SQL injection vulnerability. This flaw resides in the WP_Query class, specifically concerning the improper sanitization of the ‘author__not_in’ parameter. When untrusted data is passed through this parameter—often via third-party plugins or themes that interact with the core query system—it allows the attacker to manipulate the underlying database query.

Ben Marr, a senior security engineer at Intruder, noted that the combination of these two flaws creates a "perfect storm" for attackers. "The REST API route confusion provides the key to the front door, while the SQL injection in WP_Query provides the master key to the house’s safe," Marr explained. By manipulating the database, attackers can exfiltrate hashed credentials, modify administrative settings, or, in specific configurations, achieve remote code execution (RCE).

Crucially, the RCE component of CVE-2026-63030 is dependent on the environment’s caching configuration. Analysis from Cloudflare indicates that the remote code execution is most easily achieved when a persistent object cache is not in use. In such environments, the attacker can manipulate the database to influence the PHP execution flow. However, even in environments where RCE is mitigated by caching, the SQL injection remains a high-severity threat for data exfiltration and unauthorized access.

Chronology of Discovery and Active Exploitation

The timeline of the wp2shell crisis began in mid-2026 when Searchlight Cyber initiated an automated security audit of the WordPress core using AI-driven tools. Within ten hours, the GPT 5.6 Sol model identified the logic flaw in the REST API and the sanitization error in WP_Query. Recognizing the severity, the researchers attempted a responsible disclosure process; however, before patches could be universally adopted, public exploit code began to circulate within the underground security community.

By the early hours of a recent Saturday (UTC), global security sensors began registering successful exploitation attempts. Initially, threat actors focused on the SQL injection component to exfiltrate hashed user credentials. However, as technical nuances regarding the RCE component were leaked online, the nature of the attacks shifted toward full system takeovers.

Jake Knott, principal security researcher at watchTowr, confirmed that the exploitation was "well underway" almost immediately after the details became public. "We observed a rapid transition from targeted credential theft to widespread, indiscriminate remote code execution," Knott stated. Telemetry data from KEVIntel has since tracked malicious activity to at least 13 unique IP addresses across a diverse geographical range, including Switzerland, Germany, the United Kingdom, Indonesia, Lithuania, the Netherlands, and Singapore.

Supporting Data and Impact Analysis

The scale of the wp2shell vulnerability is vast, given WordPress’s dominance in the web hosting market. Data provided by Wiz, a cloud security firm owned by Google, suggests that at the moment of disclosure, approximately 60% of organizations utilizing WordPress had at least one vulnerable instance. More concerningly, 25% of these organizations were hosting vulnerable servers that were directly exposed to the public internet without the protection of a Web Application Firewall (WAF).

While these numbers have begun to decline as administrators apply emergency patches and security updates, the sheer volume of "stock" installations makes the cleanup process arduous. Because the exploit requires no specific plugins or themes to function—targeting the core software itself—every default installation since version 6.8 (for the SQL injection) and 6.9 (for the RCE) is a potential target.

WatchTowr’s global network of honeypots has recorded tens of thousands of exploitation attempts in a matter of days. These attempts are often "spray-and-pray" campaigns, where automated scripts scan the internet for the specific REST API endpoint and attempt to inject the malicious payload. This indiscriminate approach suggests that both sophisticated state-sponsored actors and lower-level "script kiddies" are vying for control of the same vulnerable infrastructure.

Post-Exploitation Activities and Malware Deployment

The consequences of a successful wp2shell exploitation are severe and multifaceted. Security researchers have observed a variety of post-exploitation activities designed to ensure persistence and facilitate further attacks. One of the most prevalent tools identified in the wild is a 150 KB web shell disguised as a legitimate security plugin named "CMSmap."

This malicious plugin serves as a comprehensive attack platform. Once installed, it provides the attacker with a graphical interface to manage files, access the site’s database, perform port scanning on the internal network, and inject batch code into other PHP files. The web shell also includes modules for privilege escalation, such as MySQL UDF (User Defined Function) exploitation, allowing the attacker to move from a web-user context to a full system-user context.

In addition to web shells, threat actors have been observed creating backdoor administrator accounts. To date, over 100 unique instances of unauthorized administrative accounts have been documented across various compromised sites. These accounts allow attackers to return at any time, even if the original vulnerability is patched, provided the account is not discovered and deleted.

Further investigation by Wiz researchers Shahar Dorfman and Gili Tikochinski revealed that some attackers are using their foothold to deploy secondary malware. In several cases, threat actors attempted to install the "Overlord RAT," a remote access trojan written in the Golang programming language. Overlord RAT is known for its ability to bypass traditional antivirus signatures and provides attackers with a persistent, encrypted tunnel into the victim’s server.

The Role of AI in the Modern Threat Landscape

The discovery of wp2shell via OpenAI’s GPT 5.6 Sol has sparked a renewed debate within the cybersecurity community regarding the dual-use nature of artificial intelligence. While Searchlight Cyber used the technology for defensive discovery and disclosure, the speed at which the AI identified such a deep-seated core flaw suggests that threat actors could use similar tools to find zero-day vulnerabilities in other critical software.

The fact that the exploit chain was synthesized in under 12 hours demonstrates a level of efficiency that human researchers struggle to match. This "acceleration of the exploit cycle" means that the window between the discovery of a flaw and its active exploitation is shrinking. Organizations must now contend with the reality that "security through obscurity" is no longer a viable defense, as AI tools can systematically analyze millions of lines of code to find logic errors and sanitization gaps.

Official Responses and Remediation Recommendations

In response to the escalating crisis, security organizations and WordPress core contributors have urged immediate action. The primary recommendation is for all administrators to update their WordPress installations to the latest patched version immediately. For those unable to update the core software due to compatibility concerns, implementing a Web Application Firewall (WAF) with specific rules to block malicious REST API batch requests is considered a critical interim measure.

Cloudflare and other major CDN providers have already deployed managed rulesets to protect their customers from the wp2shell exploit. However, experts warn that these defenses are not foolproof and do not address the underlying vulnerability.

Defenders are also advised to conduct a thorough audit of their WordPress environments. This includes:

1. Checking for Unauthorized Accounts: Inspecting the "Users" list for any unfamiliar accounts with administrative privileges.
2. Plugin Verification: Reviewing the installed plugins to ensure no malicious tools like "CMSmap" have been added.
3. Log Analysis: Examining server access logs for unusual requests to the /wp-json/wp/v2/batch endpoint.
4. File Integrity Monitoring: Using security tools to check for modifications to core WordPress files or the addition of suspicious PHP scripts in the wp-content/uploads directory.

Broader Impact and Future Implications

The wp2shell event serves as a stark reminder of the inherent risks associated with centralized web infrastructure. Because WordPress powers nearly 43% of all websites, a single core vulnerability has the potential to destabilize significant portions of the internet. The shift toward AI-assisted discovery only amplifies this risk, as the barrier to finding high-impact vulnerabilities continues to lower.

As organizations move toward more automated and AI-integrated workflows, the security community must adapt by employing the same technologies for defense. Continuous automated scanning, AI-driven code analysis, and rapid patch deployment are no longer optional but essential components of a modern security posture. The wp2shell exploit chain may be the first of its kind discovered in this manner, but it is unlikely to be the last, signaling a new era of high-speed, high-stakes cybersecurity.