Critical WP2Shell Vulnerability Lets Attackers Create WordPress Admin Accounts

Key Takeaways

• A critical vulnerability, dubbed WP2Shell, allows unauthenticated attackers to create WordPress administrator accounts and install web shells.
• This exploit chain combines two distinct WordPress Core flaws (CVE-2026-63030 and CVE-2026-60137) to achieve server-side code execution.
• Affected WordPress versions include 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1.
• Patches are available in WordPress versions 6.8.6, 6.9.5, and 7.0.2. Immediate upgrade is strongly recommended.
• While no widespread live exploitation has been confirmed, the vulnerability’s severity necessitates urgent action from site administrators.

A significant security flaw, termed WP2Shell, has been identified in WordPress Core, enabling attackers to bypass authentication and gain full control over vulnerable sites. This sophisticated exploit chain leverages two separate vulnerabilities to allow unauthenticated individuals to create new administrator accounts and deploy web shells, providing a persistent foothold for further malicious activity.

Security researchers at Seqrite published an analysis on October 16 detailing the WP2Shell exploit. Their report, which does not indicate widespread active exploitation at this time, notes that the underlying flaws were initially disclosed in July 2026. The critical aspect of this attack lies in its ability to circumvent the login process entirely, exposing public-facing WordPress instances before administrators might even detect suspicious accounts or plugins.

The WP2Shell Exploit Chain

Seqrite’s analysts meticulously documented WP2Shell, demonstrating how the combination of CVE-2026-63030 and CVE-2026-60137 facilitates a path from a simple, unauthenticated REST API request to full server-side code execution. Their technical breakdown of WP2Shell provides an in-depth explanation of the attack sequence and the resulting artifacts on a compromised host.

The first vulnerability, CVE-2026-63030, resides within the REST API batch controller, specifically at the /wp-json/batch/v1 endpoint. This controller is designed to process multiple API requests within a single submission. Seqrite discovered that malformed nested requests can confuse the system’s route handling, allowing access to functionalities that should typically require prior authentication. While this flaw alone does not lead to code execution, it serves as the crucial gateway to the second weakness.

The second component of the chain, CVE-2026-60137, is an SQL injection vulnerability found in the posts endpoint. This flaw stems from how the public author_exclude parameter is mapped to author__not_in within WP_Query. Seqrite’s analysis indicates that improper input handling in this parameter can directly influence the database query. When combined with the route handling vulnerability, an unauthenticated request can reach this susceptible query, leading to the establishment of an administrator-level presence and, ultimately, remote code execution.

In essence, the SQL injection allows an attacker’s input to manipulate a database query in an unintended manner. The initial flaw (CVE-2026-63030) provides the means for an unauthenticated request to reach this vulnerable query, while the second flaw (CVE-2026-60137) provides the underlying database weakness. The true impact of WP2Shell stems from the synergistic effect of these two vulnerabilities, rather than either flaw independently enabling a direct web shell. Once code execution is achieved on the server, attackers can make extensive changes beyond the typical WordPress administrative interface.

The demonstrated attack sequence is highly concerning for defenders. The exploit can create an unexpected administrator account, stage a ZIP archive in the uploads directory, unpack PHP files, and move a malicious plugin into the wp-content/plugins folder. This newly installed plugin then functions as a web shell, giving the attacker a direct interface to execute commands on the server.

Seqrite’s report details the process of temporary write checks under wp-content, followed by the staging of archives in wp-content/uploads/2026/10/ and subsequent extraction under wp-content/upgrade/. The sample archive identified is wp2shell_4e9b3641.zip, with extracted files and plugin folders following a wp2shell_ naming convention. The report notes that httpd.exe may be observed performing file writes, which can occur during legitimate plugin operations, meaning its presence alone is not definitive proof of compromise. More specific indicators, such as the WP2Shell filenames, new PHP files, and unauthorized administrator accounts, are crucial for detection.

Affected Versions and Remediation

The full WP2Shell exploit chain impacts WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Additionally, versions 6.8.0 through 6.8.5 are vulnerable to CVE-2026-60137. WordPress versions 6.8.6, 6.9.5, and 7.0.2 include the necessary fixes for these vulnerabilities. It is imperative for all administrators to upgrade to one of these patched releases or a later supported version immediately and verify that the update process completed successfully.

While restricting unauthenticated access to sensitive REST API features might offer some reduction in exposure, it should not be considered a substitute for applying the official patches. Proactive patching remains the most effective defense against this critical vulnerability.

What You Should Do

• Upgrade Immediately: Update all WordPress installations to versions 6.8.6, 6.9.5, 7.0.2, or any later supported release. Verify that the update process completes successfully.
• Review Accounts: After updating, meticulously check for any unfamiliar administrator accounts, especially those created recently.
• Inspect File System: Examine plugin and cache directories for new or modified PHP files, particularly those following the wp2shell_ pattern. Look for temp-write-test-* files and wp2shell_*.zip archives in wp-content/uploads/2026/10/ and wp2shell_ plugin folders under wp-content/upgrade/ and wp-content/plugins/.
• Check Logs: Review server and WordPress logs for suspicious requests to the /wp-json/batch/v1 endpoint.
• Indicators of Compromise (IoCs):
  • Endpoint: /wp-json/batch/v1 (REST API batch endpoint)
  • File pattern: temp-write-test-* (Temporary files under wp-content/)
  • Archive example: wp2shell_4e9b3641.zip (Sample in wp-content/uploads/2026/10/)
  • Directory pattern: wp2shell_ (Seen under upgrade and plugins directories)
  • PHP file pattern: wp2shell_.php (Example extracted filename)
  • File activity: New or changed .php files in plugins or cache folders (Compare with expected site activity)
  • Account: Unexpected administrator (Check creation time)
  • Network Detection: HTTP/CVE-2026-63030!DP.50405, HTTP/CVE-2026-63030!SP.50370 (Quick Heal detections)
  • Behavioral Detection: SL_A WP2Shell Suspicious PHP File Modification in WordPress Plugins
• Incident Response: If compromise is suspected or confirmed, preserve forensic evidence, disable any suspicious plugins, reset all affected credentials, and conduct a thorough investigation to identify and remove any persistent backdoors. A patched version number alone does not guarantee that an earlier compromise has been fully remediated.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.