WordPress Core Vulnerability wp2shell Exploited by Unauthenticated Attackers

Unauthenticated attackers can run code on WordPress sites due to a newly disclosed vulnerability in the WordPress core, known as wp2shell, which affects versions 6.9 and 7.0.

Vulnerability Mechanics

The wp2shell vulnerability allows an anonymous HTTP request to execute code on a WordPress site. This bug is particularly concerning because it is located in the WordPress core, meaning that even a bare installation with zero plugins is exploitable. According to The Hacker News, the flaw can be exploited by chaining two specific vulnerabilities, now identified as CVE-2026-63030 and CVE-2026-60137.

Technical Depth

This vulnerability can be understood through the lens of MITRE ATT&CK technique T1210: Exploitation of Remote Services, where an attacker exploits a vulnerability in a remote service to gain access to the system. The fact that this vulnerability is in the core of WordPress and does not require any plugins to be installed makes it particularly dangerous, as it increases the potential attack surface.

Who Is Affected

Any WordPress site running versions 6.9 or 7.0 is potentially affected by this vulnerability. This includes a wide range of websites, from personal blogs to large enterprise sites, given the widespread use of WordPress as a content management system.

What the Sceptics Say

Some might argue that since patches are now available, the urgency of this issue is diminished. However, given the public availability of exploits and the ease with which these vulnerabilities can be chained to achieve remote code execution, it's critical that all affected sites are updated as soon as possible to prevent exploitation.

How to Defend

• Update WordPress: Ensure that your WordPress installation is updated to the latest version, which includes patches for the wp2shell vulnerabilities.
• Monitor for Exploits: Keep an eye on security logs for signs of exploitation attempts, such as unusual HTTP requests or unexpected changes in file system or database contents.
• Implement WAF Rules: If possible, implement Web Application Firewall (WAF) rules to detect and block known exploit patterns for these vulnerabilities.

Key Takeaways

1. Security Teams: Prioritize updating WordPress sites and monitor for signs of exploitation.
2. CISOs: Ensure that vulnerability management processes are in place to quickly address critical vulnerabilities like wp2shell.
3. Developers: Be aware of the vulnerabilities in third-party components like WordPress and ensure that updates are integrated into development workflows.
4. End Users: If managing a WordPress site, take immediate action to update the site to protect against these vulnerabilities.

Sources

• The Hacker News: New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
• BleepingComputer: WordPress Core "wp2shell" RCE flaws get public exploits, patch now
• Security Affairs: Attackers Can Take Over WordPress Sites Using Newly Released wp2shell Exploits