# WordPress Just Got a Skeleton Key: Inside the wp2shell Exploit Chain That's Already Burning Across the Internet
The exploitation started before most administrators had their coffee Saturday morning.
By early UTC hours, attackers were already pulling hashed credentials from vulnerable WordPress installations — not through some obscure plugin flaw or misconfigured server, but through the core software itself. No authentication required. No plugins needed. A stock WordPress install, fresh out of the box, and you're already inside.
The vulnerability chain, now called wp2shell, combines two critical flaws — CVE-2026-63030 and CVE-2026-60137 — into something that should alarm anyone running the software that powers roughly 43% of the web. The combination yields unauthenticated remote code execution on default configurations. That's not a corner-case attack scenario. That's a worst-case one.
## How the Chain Actually Works
The technical picture here matters, so let's be specific about what's happening.
CVE-2026-60137 is the entry point. It's a route confusion bug in WordPress's REST API batch endpoint — the internal handler that processes multiple API calls in a single HTTP request. The vulnerability allows an unauthenticated user to invoke internal handlers without any permission check by exploiting how the batch processor resolves routes versus what the authentication layer validates. It's the kind of subtle architectural flaw that only becomes obvious in retrospect.
Once inside, attackers land on CVE-2026-60137's companion: a SQL injection in the WP_Query class through the author__not_in parameter. When untrusted data flows from a plugin or theme into this query builder without proper sanitization, an attacker can restructure the database query itself — leaking credentials, authentication keys, and anything else stored in the WordPress database.
CVE-2026-63030 takes it further. On installations that aren't running a persistent object cache — which, in practice, describes the majority of small and mid-sized WordPress sites — an attacker can leverage the SQL injection foothold to achieve full remote code execution. The SQL injection is present in WordPress 6.8 and later. The RCE kicks in from 6.9. Every version released since December 2025 is in play.
One HTTP request. No prior account. No special plugins. A completely default installation.
## Saturday Morning Bloodbath
Searchlight Cyber discovered the exploit chain — notably, using GPT 5.6 Sol in a 10-plus hour analysis process, which is a detail worth flagging separately about where AI-assisted vulnerability research is headed. The timeline between discovery, limited disclosure, and public exploitation was brutally short.
KEVIntel telemetry logged 13 unique IP addresses across Switzerland, Germany, the UK, Indonesia, Lithuania, the Netherlands, and Singapore hitting CVE-2026-63030 within hours of Saturday's activity beginning. By the time public exploit code was circulating, the RCE follow-up had already started.
Wiz's data tells the exposure story: when the CVEs were published, 60% of organizations using WordPress had at least one vulnerable instance. A quarter of those were exposing a vulnerable server directly to the internet. These numbers have since declined as patching accelerates, but "declining" is not "done."
The post-exploitation playbook Wiz observed is methodical rather than chaotic:
That web shell is worth its own paragraph. A 150 KB PHP shell is circulating disguised as a legitimate WordPress security plugin called CMSmap. The disguise is deliberate — it looks like exactly the kind of security tooling an administrator might install during an incident response. It's a full-featured attack platform that provides the attacker durable, flexible access long after the initial exploit would be patched.
## Who's Actually at Risk Right Now
Cloudflare's clarification matters for defenders doing triage: the RCE component requires that persistent object cache is not in use. That sounds like a narrow condition until you remember that persistent object caching — Redis, Memcached, and similar backends — is a performance optimization that requires separate infrastructure. Shared hosting environments, the backbone of small business WordPress deployments, rarely run it by default.
High-volume scanning without subsequent post-exploitation is also underway, per Wiz. This is the usual pattern: opportunistic bots map the vulnerable population now, while more targeted actors decide later which targets are worth their attention. The scan data is the asset being built.
Wiz hasn't yet observed lateral movement or data exfiltration at scale, but "not yet" is doing significant load-bearing work in that sentence.
## HackWire Analysis
wp2shell fits an uncomfortable pattern that the WordPress ecosystem keeps cycling through: architectural flaws in core software, discovered and exploited before the patch window closes, combined with a long tail of unpatched installations that keeps attack surfaces open for months.
What's different here is the AI-assisted discovery timeline. Searchlight Cyber found this chain using GPT 5.6 Sol in about 10 hours. Vulnerability research that once required weeks of manual code audit is compressing. The discovery-to-exploit gap isn't narrowing because attackers got smarter — it's narrowing because the tooling available to everyone, defenders and attackers alike, has become dramatically more capable. The next wp2shell may surface with even less warning.
The CMSmap disguise is the detail other coverage is underweighting. Deploying a malicious plugin that presents as a security tool is a social engineering move embedded in a technical exploit chain. An administrator who discovers exploitation and begins incident response might actually install the attacker's persistence mechanism themselves, believing it's a legitimate scanner. That's clever, and it suggests operators behind at least some of this activity are thinking past the initial access phase.
For defenders: the immediate priority is patching and checking for the CMSmap plugin or any recently-installed plugin with an unfamiliar or security-sounding name. Pull your WordPress wp-content/plugins/ directory and audit it before assuming you're clean. If you're on 6.8 or later and haven't patched, assume you've been scanned at minimum. Enable persistent object caching regardless — it closes the RCE vector and improves performance anyway. Review your admin user list for accounts you didn't create.
For organizations running WordPress at scale across multiple properties — agencies, media companies, enterprise deployments — this is a moment to inventory which installations are actually patched and which are running on autopilot.
— HackWire Editorial
## Related Coverage