WP2Shell Attack Lets Hackers Create WordPress Admin Accounts and Install Web Shells Without Login

WP2Shell combines two WordPress Core flaws to move from an unauthenticated request to server-side code execution. It can let an attacker create an administrator account and install a plugin-based web shell.

Seqrite’s October 16 analysis lists affected releases, but does not establish widespread live exploitation. The report says the flaws were disclosed in July 2026.

The chain matters because it removes the login step. A public site running an affected release may be exposed before an owner sees a suspicious account or plugin.

Analysts at Seqrite identified and documented WP2Shell, combining CVE-2026-63030 and CVE-2026-60137 into a route from a public REST API request to code execution.

Their technical breakdown of WP2Shell explains the sequence and host artifacts. CVE-2026-63030 affects the REST API batch controller at /wp-json/batch/v1, which processes several API requests in one submission.

Seqrite says nested requests can confuse route handling and reach functionality that should require authentication. This flaw alone does not execute code; it provides a path to the second weakness.

CVE-2026-60137 is an SQL injection flaw in the posts endpoint. The public author_exclude parameter maps to author__not_in in WP_Query.

WP2Shell Attack

According to Seqrite, poorly handled input can affect the database query. Chained with the route flaw, it lets an unauthenticated request reach the vulnerable query. The proof of concept then establishes an administrator-level foothold and remote code execution.

In simple terms, SQL injection lets input affect a database query in an unintended way. Here, the first flaw helps an unauthenticated request reach that vulnerable query; the second supplies the database weakness.

The chain’s impact comes from how the two issues work together, not from either flaw being described as a direct web shell by itself. Once code runs on the server, an attacker may have a way to make further changes beyond the WordPress dashboard.

The demonstrated steps matter to defenders. The chain can create an unexpected administrator account, stage a ZIP archive in uploads, unpack PHP files, and move a plugin directory into wp-content/plugins.

The plugin acts as a web shell, an interface for running server commands. Cybersecurity News has covered a separate WordPress account creation vulnerability and recent Comment2Shell vulnerability coverage, where different flaws also lead to account or shell risks.

Seqrite describes temporary write checks under wp-content, followed by archive staging in wp-content/uploads/2026/10/ and extraction under wp-content/upgrade/.

Sample archive

The sample archive is wp2shell_4e9b3641.zip; extracted files and plugin folders use a wp2shell_<hex> pattern. The report says httpd.exe may perform file writes, as it can during normal plugin operations.

That process name alone is not proof of compromise. More useful signs are the WP2Shell filenames, new PHP files, and unexpected administrators. A WordPress poisoned plugin supply-chain incident also involved a web shell, but used a different delivery method.

The report lists WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 as vulnerable to the full chain. Versions 6.8.0–6.8.5 are affected by CVE-2026-60137.

It lists 6.8.6, 6.9.5, and 7.0.2 as fixed. Upgrade to the appropriate fixed release or a later supported version, and verify the update completed.

Restricting unauthenticated access to sensitive REST API features may reduce exposure where practical, but does not replace patching.

After updating, review accounts for unfamiliar administrators, inspect plugin and cache folders for new or changed PHP files, and check logs for suspicious batch-endpoint requests.

Look for temp-write-test-* files, wp2shell_*.zip archives, and wp2shell_<hex> plugin folders. If found, preserve evidence, disable suspicious plugins, reset affected credentials, and investigate persistence. A patched version number alone does not prove an earlier compromise has been removed.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post WP2Shell Attack Lets Hackers Create WordPress Admin Accounts and Install Web Shells Without Login appeared first on Cyber Security News.