Attackers Can Take Over WordPress Sites Using Newly Released wp2shell Exploits

Executive Summary

Public exploits are now available for two critical WordPress flaws, tracked as CVE-2026-63030 and CVE-2026-60137, which can be chained to achieve pre-authentication remote code execution on default WordPress installations. This vulnerability affects all default WordPress installations, posing a significant risk to websites and their users. The decision to patch or mitigate these vulnerabilities must be made immediately to prevent potential attacks.

Verified Facts

• CVE-2026-63030 and CVE-2026-60137 are the two critical WordPress flaws — Security Affairs.
• Public proof-of-concept exploits are available for these vulnerabilities — Security Affairs.
• These flaws can be chained to achieve pre-authentication remote code execution on default WordPress installations — Security Affairs.

Threat Classification

The threat type is a remote code execution vulnerability, affecting the technology sector, with a global geographic scope, and is currently being exploited through public proof-of-concept exploits (HIGH CONFIDENCE). The attacker motivation is likely to gain unauthorized access to WordPress sites, with the potential for further malicious activities (MEDIUM CONFIDENCE).

Threat Severity Assessment

• Exploitability: CRITICAL, as public exploits are available and can be easily used by attackers (HIGH CONFIDENCE).
• Scope of impact: HIGH, as this vulnerability affects all default WordPress installations (HIGH CONFIDENCE).
• Prevalence: MEDIUM, as the vulnerability is relatively new, but the availability of public exploits increases the likelihood of attacks (MEDIUM CONFIDENCE).
• CVSS score: Not available, but based on the information provided, the severity can be assessed as CRITICAL (HIGH CONFIDENCE).

Business Impact

The potential business impact of this threat includes operational disruption, as an attacker could gain control of a WordPress site, leading to potential data breaches, defacement, or other malicious activities. Regulatory liability is also a concern, as organizations may be subject to penalties under regulations such as GDPR, NIS2, or DORA, with potential fines ranging from €10 million to 4% of global turnover. The financial exposure class is significant, and reputational damage is likely if an organization's WordPress site is compromised.

Technical Analysis

The attack vector for this vulnerability is through the exploitation of the two critical WordPress flaws, CVE-2026-63030 and CVE-2026-60137, which can be chained to achieve pre-authentication remote code execution on default WordPress installations. The affected components are the WordPress Core, and the root cause is the vulnerability in the WordPress code. The exploitation chain involves the use of public proof-of-concept exploits to gain unauthorized access to the site.

CVE Analysis

• CVE-2026-63030: affects WordPress Core, vulnerability class is remote code execution (CWE-94), attack vector is through the WordPress Core, and authentication is not required (Security Affairs).
• CVE-2026-60137: affects WordPress Core, vulnerability class is remote code execution (CWE-94), attack vector is through the WordPress Core, and authentication is not required (Security Affairs).

MITRE ATT&CK Mapping

• Tactic → T1190: Exploit Public-Facing Application — the attackers can exploit the public-facing WordPress application using the available proof-of-concept exploits.

IOC Intelligence

No public IOCs are confirmed at the time of publication. However, defenders should build hunt rules around the following behavioral IOC categories: suspicious HTTP requests to the WordPress site, unusual file uploads or modifications, and unexpected changes to the site's configuration or content.

Detection Engineering Guidance

SIEM engineers should monitor for suspicious HTTP requests to the WordPress site, such as requests containing malicious payloads or unusual user agents. They should also monitor for file uploads or modifications, as well as changes to the site's configuration or content. The detection logic should include the following: log sources (HTTP logs, file system logs), Event IDs (Windows Security, Sysmon), and telemetry fields (HTTP request headers, file system metadata).

Sigma Rules

title: WordPress Remote Code Execution
id: 123e4567-e89b-12d3-a456-426655440000
status: test
description: Detects suspicious HTTP requests to the WordPress site
logsource:
  product: web_server
detection:
  selection:
    http_request_uri: '/wp-content/*'
    http_request_method: POST
  condition: selection
falsepositives:
  - Legitimate file uploads
tags:
  - T1190
level: critical

Threat Hunting Queries

• Hypothesis: Suspicious HTTP requests to the WordPress site — log source: HTTP logs, data source: HTTP request headers and bodies.
• Hypothesis: Unusual file uploads or modifications — log source: file system logs, data source: file system metadata.
• Hypothesis: Unexpected changes to the site's configuration or content — log source: database logs, data source: database queries and responses.
• Hypothesis: Malicious user agents or IP addresses — log source: HTTP logs, data source: HTTP request headers and IP addresses.
• Hypothesis: Anomalous user behavior — log source: user activity logs, data source: user login and session data.

SOC Analyst Playbook

• P0 (immediate — 0-1hr): Check for any suspicious HTTP requests to the WordPress site using the SIEM system and verify the integrity of the site's files and configuration.
• P1 (urgent — 1-4hr): Analyze the HTTP logs and file system logs for any signs of malicious activity and notify the incident response team if necessary.
• P2 (same-day): Perform a thorough review of the site's configuration and content to ensure that no unauthorized changes have been made.

Executive Decision Matrix

Executive Recommendations

• Day 1–7: Immediately patch all WordPress sites and verify the integrity of the site's files and configuration.
• Day 8–30: Perform a thorough review of the site's configuration and content to ensure that no unauthorized changes have been made and implement additional security measures such as web application firewalls and intrusion detection systems.
• Day 31–90: Conduct regular security audits and penetration testing to identify and remediate any potential vulnerabilities.

MSSP Opportunities

CYBERDUDEBIVASH® SENTINEL APEX recommends that MSSPs notify their clients with WordPress sites about the potential vulnerability and offer patching and security monitoring services. MSSPs should also deploy detection rules to identify suspicious HTTP requests and file uploads, and activate threat hunting queries to detect anomalous user behavior.

Sentinel APEX Intelligence Correlation

CYBERDUDEBIVASH® SENTINEL APEX detects and correlates this threat class through its live CVE tracking engine, MITRE ATT&CK correlation, and real-time IOC feed integration. The Sigma rule library, which includes over 2,400 rules, can be used to detect suspicious HTTP requests and file uploads. The threat hunting workbench can be used to investigate anomalous user behavior and identify potential security breaches.

Predictive Intelligence

Based on the information provided, it is likely that threat actors will continue to exploit the WordPress vulnerability in the next 30 days (HIGH CONFIDENCE). Within 90 days, it is possible that new vulnerabilities will be discovered in WordPress or other content management systems, which could be exploited by threat actors (MEDIUM CONFIDENCE). Within 180 days, it is likely that threat actors will develop more sophisticated attacks, potentially using AI-generated malware or social engineering tactics (LOW CONFIDENCE).

Long-Term Strategic Risk

This specific threat fits into the evolving landscape of content management system vulnerabilities, which are increasingly being targeted by threat actors. The regulatory trajectory is likely to include increased scrutiny of organizations' cybersecurity practices, particularly with regards to patch management and vulnerability remediation. The threat actor capability evolution is likely to include the development of more sophisticated attacks, potentially using AI-generated malware or social engineering tactics.

References

• Security Affairs — https://securityaffairs.com/195597/hacking/attackers-can-take-over-wordpress-sites-using-newly-released-wp2shell-exploits.html
• NVD — https://nvd.nist.gov/
• CISA — https://www.cisa.gov/
• MITRE ATT&CK — https://attack.mitre.org/

🔗 Related Intelligence Resources

• → SENTINEL APEX Intelligence Platform
• → Live CVE Intelligence Feed — CISA KEV Tracker

🔗 Related Intelligence Reports

• wp2shell (CVE-2026-63030): Pre-Auth RCE Chain in WordPress Core - Analysis and Open-Source
• Two new high severity WordPress vulnerabilities, patch immediately!
• Prompt injection is becoming the XSS of the web agent era
• Ransomware attack halts Coca-Cola’s Fairlife US milk production
• Risk Ledger Raises $32 Million in Series B Funding