GoKawiilHackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers.
The critical exploit chain abuses the WordPress REST API’s batch-processing feature, allowing remote attackers to execute code on vulnerable installations without the need to authenticate.
Although the technical details were not released, proof-of-concept exploits started to emerge over the weekend, shortly after threat intelligence and cyber risk management company SearchLight Cyber disclosed the wp2shell security issue.
Active exploitation was quickly confirmed, immediately after WordPress addressed the problem in versions 7.0.2, 6.9.5, and 6.8.6, forcing automatic security updates for supported installations.
Cloud security company Wiz has shared technical details about observed attacks leveraging wp2shell, saying that threat actors performed the following activities:
Mass-scanning for vulnerable WordPress installations (much of it is security scanning).
Abuse of WordPress plugin upload functionality to install malicious add-ons.
Installation of PHP webshells ranging from simple one-liner backdoors to feature-rich, obfuscated shells disguised as plugins (CMSmap).
Querying the WordPress REST API to collect administrator usernames and email addresses.
Local file inclusion attempts targeting wp-config through admin-ajax.php to retrieve database credentials and authentication keys.
... continue reading