TLP: CLEAR
CanSSOC Threat Assessment ^[*]: HIGH

1. Summary
2. Details
3. Recommendations
4. Mitigations
5. References
6. Support

Researchers have identified two vulnerabilities in WordPress Core dubbed ‘wp2shell’ which, when, chained together, can allow unauthenticated attackers to gain remote code execution on default WordPress installations in any WordPress version released since December 2025.

Following the exploit chain’s disclosure, numerous exploit proofs-of-concept were made available by researchers. Most early attempts were able to achieve SQL injection on default configurations while later attempts achieved full remote code execution against arbitrary targets.

Multiple actors have been observed successfully exploiting this vulnerability chain followed by the following post-exploitation activities:

• Malicious plugin upload to install persistent backdoors.
• User enumeration to harvest administrator usernames and email addresses.
• Local file inclusion attempts targeting database credentials and authentication keys for exfiltration.
• Admin panel access.

Among the successful attempts, two PHP-based webshells were also observed being installed post-exploitation. One was a single-line script acting as a bare bones backdoor, while the other was a webshell disguised as a WordPress plug-in called ‘CMSmap’.

We are asking institutions that have the resources to investigate activity related to the shared indicators to do so and report the information back to CanSSOC via your institutional Slack channel or via security@canssoc.canarie.ca.

• CVE:
  • CVE-2026-63030 – CVSS: 9.8 EPSS: 8.95% / P95
  • CVE-2026-60137 – CVSS: 5.9 EPSS: 4.03% / P89
• Impacted versions:
  • Full exploit chain
    • WordPress Core versions 6.9.0 through 6.9.4
    • WordPress Core versions 7.0.0 through 7.0.1
  • CVE-2026-60137 (SQLi)
    • WordPress Core versions 6.8.0 through 6.8.5
• Active exploitation:
  • Researchers have noted multiple actors successfully exploiting this chain against WordPress instances self-hosted in the cloud.
  • They also note high-volume scanning activity without subsequent post-exploitation, suggesting opportunistic mass-scanning campaigns.

• Ensure that all systems are running the latest security patches and are up to date based on the vendor’s recommendation.
• Consult logs for HTTP 207/200 Multi-Status responses to batch endpoint requests as these as shown to be high-fidelity indicators of compromise.
• Consult logs for user agent strings containing ‘wp2shell’ and ‘rezwp2shell’ as these also indicate likely compromise.
• For those organizations that cannot immediately update, they can restrict anonymous access to the WordPress Batch API by blocking the ‘/wp-json/batch/v1’ endpoint at a web application firewall, or by disabling anonymous REST API access using a plug-in.

For instances that cannot be updated immediately, block anonymous access to the batch API at the WAF or reverse proxy — both /wp-json/batch/v1 and ?rest_route=/batch/v1 must be covered, as the second form works even where rewrite rules are disabled. A plugin that disables anonymous REST API access achieves the same result.

These are emergency measures but come at a functional cost — the block editor uses the batch API during normal editing, so authors will hit failures.

1. [Advisory] – Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25
2. [Vendor release] – WordPress 7.0.2 release
3. [MISP] – Security guidance
4. [CCCS] – Cyber security guidance

As always, please let us know if you have any questions or concerns or see unusual activity on your systems that you believe might be associated with this or any other vulnerability. Please send these communications to security.response@utoronto.ca.

[*] The CanSSOC Threat Assessment has the following four scores: LOW, MEDIUM, HIGH, SEVERE.