Securing WordPress Against Active wp2shell Exploits

According to BleepingComputer, active exploitation of the critical WordPress Core “wp2shell” flaws—CVE-2026-63030 and CVE-2026-60137—is deploying persistent webshells and malicious plugins on exposed sites. The issue is not a theoretical patch-cycle item: researchers report unauthenticated remote code execution through the REST API batch-processing feature. For WordPress operators, the relevant metric is patch state and post-compromise evidence, not the volume of exploit headlines.

Patch baseline: eliminate the vulnerable Core range

The reported affected releases are WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. WordPress addressed the flaws in 7.0.2, 6.9.5, and 6.8.6, and forced automatic security updates for supported installations.

1. Record the installed Core version on every production node.

2. Confirm that no instance remains on the reported vulnerable releases.

3. Treat failed, deferred, or blocked automatic updates as an operational exception.

4. Verify the production filesystem after the update. A successful dashboard update alone does not establish that the host was not already modified.

The exposed surface is WordPress Core. The reported attack requires no authentication and no plugin dependency on a stock installation.

Log review: isolate REST API and SQL-injection probing

Observed activity reportedly begins with probing intended to confirm SQL-injection exposure, followed by delivery of a PHP webshell. Defiant observed initial exploitation-related probing at 23:29 UTC on July 17, with a clear SQL-injection attempt 13 minutes later.

Review access, application, and security logs in this order:

1. Filter REST API batch-processing requests around the period before and after patching.

2. Identify repeated anonymous requests, failed requests, and requests followed by PHP file creation.

3. Compare request timestamps against changes to plugin directories, cache directories, and user records.

4. Preserve relevant log entries before rotation or retention jobs remove them.

Do not use a clean update result as a substitute for log inspection. The reported exploit chain can result in code execution before an administrator sees a conventional WordPress-level warning. If logging is incomplete, the absence of an alert is not a clean finding.

Filesystem and account integrity checks

The reported webshell activity includes files under /wp-content/cache/ with randomized names. One described mechanism returned a fake 404 page unless a password-like value was supplied through a URL-request variable. The published webshell checks whether PHP execution functions such as system, passthru, exec, shell_exec, popen, or the backtick operator are available.

Run the following checks against the known-good deployment state:

1. Inspect /wp-content/cache/ for recently created or unexpected PHP files.

2. Review newly installed and modified plugins. Remove only after preserving evidence required for incident analysis.

3. Audit administrator accounts for unexpected additions.

4. Correlate new admin accounts with REST API requests and filesystem timestamps.

5. Recheck Core version after remediation and confirm that unsupported or unpatched instances are not still serving traffic.

BleepingComputer reports no observed lateral movement or data exfiltration in the activity it cited, but that is not evidence that an individual site was untouched. The minimum closure condition is narrower: patched Core, no unexplained PHP additions, no rogue administrator accounts, and logs reviewed for wp2shell-related requests.