81.6% of the 124,580 WordPress sites surveyed have already applied the emergency patches for the wp2shell exploit, but the remaining 18.4% are still sitting on a dangerously open door. That’s the stark figure that Macnica researcher Yutaka Sejiyama’s live dashboard revealed on July 21, 2026.
Key Takeaways
- CVE‑2026‑63030 and CVE‑2026‑60137 let attackers run code via the REST API without authentication.
- WordPress responded with automatic updates in versions 7.0.2, 6.9.5, and 6.8.6.
- Threat actors are mass‑scanning, uploading malicious plugins, and dropping PHP webshells in /wp-content/cache/.
- Defiant logged the first probing at 23:29 UTC on July 17, followed by a SQL injection 13 minutes later.
Historical Context
The WordPress REST API was introduced several years ago to give developers a programmatic way to interact with core data. Since its debut, the API has been a double‑edged sword: it powers countless integrations, yet it also opens a surface that attackers can probe. Earlier disclosures around unauthenticated endpoints showed that even a single overlooked parameter could let a script enumerate users or expose configuration details.
Those lessons shaped the core team’s response when the wp2shell chain surfaced. The team had already built an automatic‑update pipeline for critical fixes, a process that proved invaluable in the current emergency. The rapid rollout of patches across three active branches mirrors the cadence seen after previous high‑profile vulnerabilities, where the community rallied to push updates before large‑scale exploitation could take hold.
That history matters. It reminds operators that any new feature added to the core can become a target if not hardened from day one. The wp2shell incident is the latest reminder that the balance between openness and security is fragile, and that past incidents often foreshadow the tactics we see today.
wp2shell exploit forces urgent WordPress patches
When SearchLight Cyber first disclosed the wp2shell security issue, the clock started ticking for every WordPress admin. The vulnerability lives in the core REST API’s batch‑processing endpoint, and it doesn’t even ask for a login. That means anyone who can reach the API can stitch together a malicious batch request and execute arbitrary PHP on the server.
WordPress didn’t waste a second. The core team shipped emergency patches in three separate branches—7.0.2, 6.9.5, and 6.8.6—forcing automatic updates on all supported installations. If you’re still on an older release, you’re basically handing a backdoor to anyone who’s scanning the internet.
How the chain works
The exploit abuses the REST API’s ability to process multiple actions in a single call. Attackers craft a payload that first uploads a malicious plugin, then triggers its activation, and finally drops a PHP webshell. Because the API call bypasses authentication, the whole chain runs without any credentials. The proof‑of‑concept wasn’t released, but the observed behavior matches the classic “upload‑then‑execute” pattern that we’ve seen in other WordPress attacks.
Technical Architecture of the wp2shell Exploit
At the heart of the attack is the batch‑processing route, which accepts a JSON array of actions. Each action can be a separate REST call, and the server executes them sequentially. The first element in the array typically contains a file‑upload request that places a plugin archive into the /wp-content/plugins/ directory. The second element invokes the plugin activation endpoint, which tells WordPress to load the newly added code.
Once the malicious plugin is active, it writes a PHP file into the /wp-content/cache/ folder. That location is writable by the web server and is not normally scanned by security tools, making it an ideal drop point. The webshell file is named with a random string, which also serves as a secret token. When an attacker later requests that URL with the token attached, the shell executes any PHP commands it receives.
Because the shell checks for a suite of execution functions—system(), exec(), and the like—it can run commands ranging from simple directory listings to full system compromises. The entire flow happens in under a minute once the attacker reaches the endpoint, which explains the rapid succession of events recorded by Defiant.
Observed attacker tactics beyond the initial breach
Cloud‑security firm Wiz has been tracking the real‑world fallout, and their telemetry paints a clear picture of what threat actors are doing once they’ve gained a foothold.
Wiz’s activity breakdown
- Mass‑scanning for vulnerable WordPress installations, largely using automated security scanners.
- Abuse of plugin upload functionality to slip malicious add‑ons onto target sites.
- Installation of PHP webshells ranging from one‑liner backdoors to fully obfuscated shells masquerading as plugins (CMSmap).
- Querying the REST API to harvest administrator usernames and email addresses.
- Local file inclusion attempts via admin‑ajax.php aimed at extracting wp‑config values, including DB credentials and auth keys.
- Deployment of a malicious plugin that exposes a custom REST endpoint for remote command execution.
- Successful login to WordPress admin panels, often after creating rogue admin accounts.
Wiz says it hasn’t seen any lateral movement or data exfiltration yet, but the foothold gives attackers a persistent backdoor that can be used for future campaigns.
Research insights from Sans and Defiant
Johannes B. Ullrich, Dean of Research at the Sans Technology Institute, published a separate report that dives into the two‑stage attack pattern. First, attackers probe for a SQL injection that confirms the vulnerability. Once they’ve validated the vector, they deliver a PHP webshell into the /wp‑content/cache/ directory. The filename is randomized, and the same string doubles as a password embedded in the URL request; any other request returns a fake 404 page.
The webshell itself checks for the presence of several PHP execution functions—system(), passthru(), exec(), shell_exec(), popen(), and the backtick operator—so it can run commands on the host. Ullrich also observed that some actors create rogue administrator accounts, a move that lets them bypass any future hardening attempts.
Indicators to hunt
- Unexpected PHP files under /wp‑content/cache/ with random names.
- Log entries showing batch‑processing calls to the REST API from unknown IPs.
- Failed LFI attempts targeting wp‑config via admin‑ajax.php.
- New admin users that weren’t created through the normal WordPress UI.
- Plugin files that appear to be obfuscated or that reference CMSmap.
Defiant’s “aftermath” post confirmed the timeline: the first probing hit at 23:29 UTC on July 17, and a clear SQL injection followed just 13 minutes later. That rapid succession underscores how quickly the exploit chain can move from reconnaissance to full compromise.
Patch adoption and ongoing monitoring
Macnica’s live dashboard, which aggregates data from over a hundred thousand WordPress sites, shows an 81.6% patch rate. That’s a solid majority, but the remaining unpatched chunk still represents a massive attack surface. The sample size—124,580 websites—gives us confidence that the numbers are representative of the broader WordPress ecosystem.
Given the speed at which the wp2shell exploit spread, administrators need to treat the patch numbers as a lower bound. If your site isn’t on one of the patched versions, you’re effectively exposing a vector that lets attackers install webshells without ever touching a password.
What This Means For You
If you run a WordPress site, the first thing you need to do is verify you’re on version 7.0.2, 6.9.5, or 6.8.6—or a later release. Check your update logs for the automatic security patch that WordPress pushed out after the vulnerability was disclosed. If you don’t see it, force a manual update immediately.
Next, comb through your logs for any of the indicators listed above. Look for batch‑processing calls to the REST API, stray PHP files in the /cache/ directory, and any new admin accounts that weren’t created through the UI. Removing rogue plugins and scanning for hidden webshells should be part of your post‑mortem routine.
Finally, consider tightening your REST API exposure. Restricting access to trusted IP ranges, disabling the batch‑processing endpoint where it isn’t needed, and employing a Web Application Firewall can buy you time before a new exploit surfaces.
Will the next WordPress core update include more granular controls for the REST API, or will attackers keep finding ways to sidestep the same mechanisms? The arms race is clearly far from over.
Concrete Scenarios for Different Operators
Small blog owners often rely on shared hosting and default settings. For them, the quickest win is to run the built‑in update checker, confirm the version number, and delete any unused plugins. A single stray plugin can become the launchpad for a webshell, so a tidy plugin list reduces risk dramatically.
Mid‑size e‑commerce sites typically run custom themes and a handful of premium extensions. Those extensions may interact with the REST API for inventory sync or order processing. In that environment, disabling batch‑processing for unauthenticated callers while keeping it enabled for internal services prevents the exploit from reaching the upload step.
Enterprise SaaS platforms that host multiple WordPress instances for clients need a layered approach. Centralized monitoring can flag the specific log patterns described earlier, and a policy that forces every site onto the latest patch level eliminates the vulnerable window. Automating the removal of any file that appears in /wp‑content/cache/ with a.php extension adds an extra safety net.
Each of these situations shares a common thread: visibility, verification, and swift remediation. When those three steps are in place, the damage from a chain like wp2shell can be contained.
Key Questions Remaining
- Will future WordPress releases provide native authentication for batch‑processing calls, or will developers need to rely on external gatekeepers?
- How can security tools improve detection of PHP files dropped in writable directories that are not part of the plugin ecosystem?
- What governance models can community maintainers adopt to audit new REST endpoints before they merge into core?
Answers to those questions will shape the next wave of defenses. Until then, staying patched and watching for the tell‑tale signs remains the best strategy.
Sources: BleepingComputer, Sans Technology Institute
