Summary Points
- The "wp2shell" vulnerability is an unauthenticated SQL injection in WordPress Core, exploited via the REST API to execute remote code and deploy webshells.
- Attackers can use UNION-based SQL injection payloads to create PHP webshells in the server’s cache directory, enabling persistent, stealthy remote access.
- Exploits have been observed deploying malicious PHP files and adding admin users, significantly compromising website integrity, data, and control.
Threat, Attack Techniques, and Targets
Last week, a new vulnerability named “wp2shell” was reported, now assigned CVE-2026-63030. This vulnerability affects WordPress and is based on an SQL injection flaw in the WordPress core. Attackers are exploiting this flaw through the REST API, which must be exposed on the WordPress site. They use standard SQL injection methods, specifically UNION queries, to test for vulnerabilities and then deliver malicious payloads. The attacks include injecting a web shell, which is a PHP script that allows remote control of the affected site. Targets are WordPress sites with exposed REST APIs and misconfigured or unpatched systems.
Impact, Security Implications, and Remediation Guidance
This vulnerability can lead to critical outcomes such as remote code execution without authorisation. Attackers can gain full control over the compromised WordPress server. They can also add new administrator accounts and upload malicious files, like web shells, which remain hidden and can be used at any time. This severely impacts the security of the site, data integrity, and potentially the entire web hosting environment. Because remediation guidance is not provided in the report, users are advised to consult the official vendor or security authorities for patched versions and best practices. It is recommended to check if the REST API is exposed on your WordPress system and disable it if not needed, especially until patches are applied. Always ensure systems are updated to the latest security versions.
Expand Your Tech Knowledge
Explore the future of technology with our detailed insights on Artificial Intelligence.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
