Two critical vulnerabilities in WordPress Core (CVE-2026-60137 and CVE-2026-63030) are being actively exploited in the wild through a campaign dubbed “WP2Shell.” These flaws allow unauthenticated attackers to achieve remote code execution and complete site takeover on millions of WordPress installations. The vulnerabilities affect WordPress versions 6.4.0 through 6.7.2, with proof-of-concept exploits publicly available and widespread scanning activity detected. Administrators must immediately update to WordPress 6.7.3 or apply emergency patches to prevent compromise.
Introduction
WordPress, powering approximately 43% of all websites globally, faces one of its most severe security crises in recent years. Security researchers have identified two critical vulnerabilities that, when chained together, provide attackers with a straightforward path to complete website compromise without requiring authentication. The exploitation campaign, tracked as WP2Shell, has already targeted thousands of vulnerable installations within 48 hours of public disclosure.
What makes this situation particularly dangerous is the trivial nature of exploitation. Unlike previous WordPress vulnerabilities requiring specific configurations or plugin combinations, these flaws exist in WordPress Core itself and affect default installations. The attack complexity is low, the exploits are reliable, and attackers need no specialized knowledge to weaponize publicly available proof-of-concept code.
Background & Context
CVE-2026-60137 represents an authentication bypass vulnerability in WordPress’s REST API implementation, specifically affecting the user enumeration and authentication validation mechanisms. This flaw enables attackers to bypass authentication checks by manipulating specially crafted API requests that exploit improper input validation in the wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php file.
CVE-2026-63030 is a privilege escalation and remote code execution vulnerability in the WordPress plugin upload functionality. When combined with the authentication bypass, this flaw allows attackers to upload malicious PHP files disguised as plugins, achieving arbitrary code execution with web server privileges.
The vulnerabilities were discovered independently by two security researchers in early January 2026. WordPress was notified through their responsible disclosure program on January 15, 2026, and worked to develop patches. However, details leaked on underground forums approximately two weeks before the official patch release, giving threat actors a head start in developing exploitation tools.
Technical Breakdown
CVE-2026-60137: Authentication Bypass
The authentication bypass exploits a logic flaw in WordPress’s REST API request handling. When processing certain API endpoints, WordPress fails to properly validate the X-WP-Nonce header combined with manipulated _wpnonce parameters, allowing attackers to forge valid authentication states.
The vulnerable code path:
// Simplified vulnerable code pattern
if ( ! wp_verify_nonce( $nonce, 'wp_rest' ) ) {
if ( ! is_user_logged_in() ) {
return new WP_Error( 'rest_forbidden' );
}
}
// Vulnerable: assumes authentication if nonce check is bypassedExploitation involves sending a crafted POST request:
curl -X POST "https://target.com/wp-json/wp/v2/users/1" \
-H "Content-Type: application/json" \
-H "X-WP-Nonce: 0" \
-d '{"id":1,"roles":["administrator"],"_wpnonce":"bypass_sequence"}'CVE-2026-63030: Plugin Upload RCE
Once authentication is bypassed, attackers exploit the plugin upload mechanism to achieve code execution. The vulnerability exists in the plugin installation handler, which inadequately validates file contents when Content-Type headers are manipulated.
The attack chain:
- Craft a malicious PHP payload disguised as a plugin
- Use bypassed authentication to access
/wp-admin/plugin-install.php - Upload the malicious “plugin” with manipulated MIME types
- WordPress automatically extracts and places the file in the plugins directory
- Direct access to the uploaded PHP file executes attacker code
Minimal weaponized payload:
Exploitation Chain
The complete WP2Shell attack sequence:
- Target reconnaissance via
xmlrpc.phpor REST API discovery - Authentication bypass via CVE-2026-60137
- Malicious plugin upload via CVE-2026-63030
- Web shell activation and post-exploitation activities
- Persistence mechanisms (backdoor accounts, cron jobs)
Impact & Risk Assessment
The severity of these vulnerabilities cannot be overstated. With CVSS v3.1 scores of 9.8 (Critical) for CVE-2026-60137 and 9.9 (Critical) for CVE-2026-63030, these flaws represent an existential threat to millions of WordPress installations.
Immediate Risks:
- Complete Site Takeover: Attackers gain administrator-level access to WordPress installations
- Data Breach: Access to databases containing user credentials, personal information, and business data
- Malware Distribution: Compromised sites serve malware to visitors, damaging reputation and enabling further attacks
- SEO Poisoning: Injection of spam content and malicious redirects destroying search engine rankings
- Lateral Movement: Compromised hosting environments enable attacks on adjacent websites and infrastructure
Affected Versions:
- WordPress 6.4.0 through 6.7.2 (all editions)
- Multisite installations are equally vulnerable
- Estimated 35+ million active installations at risk
Attack Surface:
Active scanning campaigns show attackers probing for vulnerable installations across hosting providers worldwide. Shodan and Censys data indicates automated exploitation attempts targeting managed WordPress hosting, shared hosting environments, and cloud-deployed instances.
Vendor Response
WordPress released emergency security updates on March 15, 2026, addressing both vulnerabilities. The WordPress Security Team issued the following statement:
“WordPress versions 6.7.3, 6.6.4, 6.5.6, and 6.4.4 are now available. These releases include critical security fixes for CVE-2026-60137 and CVE-2026-63030. We strongly urge all WordPress site owners to update immediately. Sites with automatic background updates enabled will receive these patches automatically.”
Patched Versions:
- WordPress 6.7.3 (current release)
- WordPress 6.6.4 (legacy branch)
- WordPress 6.5.6 (legacy branch)
- WordPress 6.4.4 (legacy branch)
The patches implement proper nonce validation, strengthen authentication checks, and add file validation layers to the plugin upload mechanism. WordPress.org has also implemented server-side detection to identify and notify administrators of potentially compromised installations.
Mitigations & Workarounds
Immediate Actions:
- Update WordPress Core immediately to version 6.7.3 or the latest patched version for your branch:
# Via WP-CLI
wp core update --version=6.7.3
# Via SSH/terminal
cd /path/to/wordpress
wp core update
- Emergency Workaround (if immediate updating is impossible):
Add to .htaccess (Apache):
Order Deny,Allow
Deny from all
Allow from [your_admin_IP]
Or add to nginx.conf (Nginx):
location ~ /wp-json/ {
deny all;
allow [your_admin_IP];
}- Disable plugin/theme installation via
wp-config.php:
define('DISALLOW_FILE_MODS', true);- Review administrator accounts for unauthorized additions:
wp user list --role=administrator- Check for suspicious plugins:
wp plugin list
# Review upload dates and unfamiliar pluginsDetection & Monitoring
Indicators of Compromise:
Monitor logs for these patterns:
# Check access logs for exploitation attempts
grep "wp-json/wp/v2/users" /var/log/apache2/access.log | grep -E "POST|PUT"
# Identify suspicious plugin uploads
find /var/www/html/wp-content/plugins/ -type f -name "*.php" -mtime -7
# Check for web shells
grep -r "system\|exec\|shell_exec\|passthru" /var/www/html/wp-content/plugins/
Log Signatures:
- Multiple POST requests to
/wp-json/wp/v2/users/with varying headers - Unusual
X-WP-Nonceheader values (particularly “0” or empty strings) - Plugin installation activities from unexpected IP addresses
- POST requests to
/wp-admin/plugin-install.phpoutside normal maintenance windows
SIEM Detection Rules:
# Example Sigma rule pattern
detection:
selection:
cs-uri-stem|contains: '/wp-json/wp/v2/users'
cs-method: 'POST'
cs-header|contains: 'X-WP-Nonce: 0'
condition: selectionSecurity Plugin Recommendations:
- Wordfence Security (enable WAF rules for CVE-2026-60137/63030)
- Sucuri Security (includes virtual patching)
- iThemes Security (enable REST API security features)
Best Practices
Preventive Measures:
- Enable Automatic Updates:
// Add to wp-config.php
define('WP_AUTO_UPDATE_CORE', true);- Implement Web Application Firewall (WAF):
– Cloudflare WAF with WordPress-specific rulesets
– ModSecurity with OWASP Core Rule Set
– Managed WordPress hosting with built-in protection
- Restrict wp-admin Access:
Order Deny,Allow
Deny from all
Allow from [admin_IP_range]
- File Integrity Monitoring:
# Install AIDE or Tripwire
apt install aide
aide --init- Regular Security Audits:
– Weekly vulnerability scans using WPScan
– Monthly security plugin reviews
– Quarterly penetration testing for business-critical sites
- Backup Strategy:
– Daily automated backups stored off-site
– Test restoration procedures monthly
– Maintain at least 30 days of backup history
Key Takeaways
- CVE-2026-60137 and CVE-2026-63030 represent critical vulnerabilities enabling unauthenticated remote code execution on WordPress installations
- Active exploitation campaigns (WP2Shell) are targeting vulnerable sites with automated tools and publicly available exploits
- Immediate updating to WordPress 6.7.3 or applying emergency workarounds is essential to prevent compromise
- The vulnerabilities affect WordPress Core, not plugins, making virtually all WordPress sites potentially vulnerable
- Organizations running WordPress must implement defense-in-depth strategies including WAF, access controls, and monitoring
- Compromised sites require complete incident response procedures including forensic analysis, malware removal, and credential rotation
The WP2Shell exploitation campaign demonstrates the ongoing challenge of securing widely deployed CMS platforms. With WordPress’s massive install base, even brief windows between disclosure and patching create opportunities for mass compromise. Organizations must prioritize rapid patch deployment and maintain robust security monitoring to detect compromise indicators early.
References
- WordPress Security Release Announcement: https://wordpress.org/news/2026/03/wordpress-6-7-3-security-release/
- CVE-2026-60137 – NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-60137
- CVE-2026-63030 – NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-63030
- WordPress Codex – Hardening WordPress: https://wordpress.org/support/article/hardening-wordpress/
- WP-CLI Documentation: https://wp-cli.org/
- OWASP WordPress Security Guide: https://owasp.org/www-project-wordpress-security/
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
