Critical WordPress Flaw 'wp2shell' Exploited: Act Now to Secure Your Servers

Urgent WordPress Core Vulnerability: What You Need to KnowAdministrators of WordPress sites across Spain and beyond are facing a serious security chal...

Urgent WordPress Core Vulnerability: What You Need to Know

Administrators of WordPress sites across Spain and beyond are facing a serious security challenge. A chain of critical vulnerabilities, collectively known as wp2shell, is being actively exploited in the wild. This exploit chain allows attackers to execute arbitrary code on your server without any credentials, effectively taking full control. If you manage WordPress installations, especially those exposed to the internet, immediate action is required.

Understanding the wp2shell Attack Chain

The wp2shell exploit targets WordPress Core versions 7.0.x (before 7.0.2), 6.9.x (before 6.9.5), and also affects the 6.8.x branch (patched in 6.8.6). The attack leverages the WordPress REST API, specifically its batch processing endpoint. Two distinct vulnerabilities are chained together:

CVE-2026-63030: A path confusion issue in the batch processing endpoint.
CVE-2026-60137: An SQL injection vulnerability in WP_Query, triggered via the author__not_in parameter.

By combining these flaws, attackers can escalate from crafted requests to full remote code execution (RCE) without authentication. This means they can run arbitrary commands on your server, install malicious software, and steal sensitive data.

How Attackers Exploit the Vulnerability

Security researchers have observed automated campaigns scanning the internet for vulnerable WordPress installations. The typical attack flow includes:

Mass scanning of WordPress sites to identify vulnerable versions.
Querying the REST API to enumerate administrator usernames and email addresses.
Attempting local file inclusion to read sensitive files like wp-config.php, which contains database credentials and authentication keys.
Once access is gained, attackers deploy persistent backdoors, such as PHP webshells disguised in wp-content/cache directories.
They may also create rogue admin accounts or install malicious plugins to maintain control.

Immediate Steps to Mitigate Risk

If you run WordPress, follow these steps without delay:

Update WordPress Core to the latest patched version: 7.0.2, 6.9.5, or 6.8.6, depending on your branch. Enable automatic security updates to prevent future lapses.
Review your logs for suspicious activity, especially requests to the REST API and batch endpoints. Look for patterns of mass scanning or unusual queries.
Inspect installed plugins and remove any that are not essential or that you don't recognize. Pay special attention to recently added plugins.
Check for new PHP files in unexpected locations, particularly within wp-content. Webshells often have random names and return a fake 404 error unless accessed with a specific parameter.
Audit user accounts with administrator privileges. Delete any accounts that you didn't create or that seem suspicious.

If You Suspect a Breach

If you notice any signs of compromise, such as unexpected files or unknown admin users, act decisively:

Contain the breach: Isolate the affected server from the network to prevent further damage.
Rotate all credentials: Change database passwords, WordPress admin passwords, and any API keys. If wp-config.php was exposed, assume all secrets are compromised.
Reinstall from a clean backup: Restore your site from a known-good backup taken before the compromise. Ensure the backup is clean and free of malware.
Consider a full server audit: Look for other backdoors or persistence mechanisms that attackers may have installed outside WordPress.

Proactive Server Security: Beyond Patching

While patching is critical, a robust security posture requires more. For businesses in Lleida, Barcelona, or anywhere in Catalonia, relying on manual updates and log reviews can be overwhelming. This is where a centralized security management solution becomes invaluable. Services like Abuse Shield offer a proactive approach to server protection:

Automatic IP blocking: Instantly block malicious IPs before they can probe your WordPress site.
Managed fail2ban: Deploy and manage fail2ban across multiple servers from a single dashboard, ensuring consistent protection.
Shared reputation feed: Benefit from a community-driven database of known malicious IPs, so your servers are protected against threats already seen elsewhere.

By centralizing your security efforts, you reduce the risk of missing a critical update or failing to detect an intrusion. In the face of active exploits like wp2shell, such measures are not just recommended—they are essential for business continuity.

Conclusion

The wp2shell vulnerability is a stark reminder that WordPress sites are prime targets for cybercriminals. Immediate patching is your first line of defense, but don't stop there. Implement a layered security strategy that includes regular audits, proactive monitoring, and automated protection. For organisations that prefer to focus on their core business, partnering with a managed security provider can offer peace of mind and robust protection against evolving threats.

Put these ideas into practice

Talk to ALMC about a solution for your business. Explore your options or contact our team.

Results without leaving the page.