WP2Shell Attack Chains WordPress Vulnerabilities for Unauthenticated Admin Account Creation and Web Shell Deployment
A novel attack dubbed WP2Shell exploits two chained WordPress core flaws to allow unauthenticated attackers to create administrator accounts and install web shells.
A sophisticated attack, identified as WP2Shell, has emerged, capable of granting unauthenticated attackers full administrative control over WordPress websites and enabling the deployment of web shells. This exploit chains together two previously disclosed WordPress core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, to bypass the standard login process and achieve server-side code execution. The attack's significance lies in its ability to move from a simple, unauthenticated request to a complete system compromise without requiring any user credentials.
The WP2Shell attack leverages a flaw in the REST API batch controller (CVE-2026-63030), which allows for multiple API requests to be processed in a single submission. By crafting nested requests, attackers can confuse the route handling mechanism and access functionalities that should be protected and require authentication. While this vulnerability alone does not lead to code execution, it provides a critical pathway to exploit the second weakness in the chain.
The second vulnerability, CVE-2026-60137, is an SQL injection flaw present in the posts endpoint. This flaw can be triggered when the author_exclude parameter, which maps to author__not_in in WP_Query, receives poorly handled input. When combined with the REST API batch controller flaw, an unauthenticated attacker can send a malicious request that reaches this vulnerable query, leading to unintended database manipulation.
Once the SQL injection is successfully exploited via the chained vulnerabilities, the attack proceeds to establish an administrator-level foothold and achieve remote code execution. The proof-of-concept demonstrated by researchers involves several stages: creating a new administrator account, staging a ZIP archive containing malicious files within the website's uploads directory, unpacking these files, and finally moving the unpacked plugin directory into the wp-content/plugins folder. This effectively installs a functional web shell, providing attackers with a persistent interface to execute arbitrary commands on the server.
The WP2Shell attack affects WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Versions 6.8.0 through 6.8.5 are also vulnerable to the SQL injection flaw (CVE-2026-60137) independently. Fortunately, WordPress has released patches for these issues, with versions 6.8.6, 6.9.5, and 7.0.2, along with subsequent releases, addressing the vulnerabilities. Users are strongly advised to update their WordPress installations to the latest available version immediately.
While Seqrite, the security firm that analyzed the attack, noted that widespread exploitation had not yet been established as of their October 16 analysis, the potential for damage is considerable. The attack bypasses the need for login, meaning a compromised site could be taken over before administrators even notice suspicious activity. Defenders should not only update their systems but also actively review user accounts for unfamiliar administrators, inspect plugin and cache directories for newly created or modified PHP files, and scrutinize server logs for suspicious requests to the batch endpoint.
Indicators of compromise include temporary files like temp-write-test-* under wp-content, ZIP archives named wp2shell_*.zip in the uploads directory, and plugin folders with patterns like wp2shell_<hex>. The presence of new or changed PHP files within plugin or cache directories, especially those with wp2shell in their names, should also raise alarms. Quick Heal has also reported network detections related to CVE-2026-63030, indicating that threat intelligence platforms are beginning to identify related activity.
To mitigate the risk, beyond immediate patching, administrators can consider restricting unauthenticated access to sensitive REST API features where feasible, though this is not a substitute for applying security updates. In the event of a suspected compromise, it is crucial to preserve evidence, disable any suspicious plugins, reset all administrative credentials, and conduct a thorough investigation to ensure persistence mechanisms have been removed.