WordPress "wp2shell" RCE bug added to CISA KEV
Two chained WordPress vulnerabilities, dubbed wp2shell, enable unauthenticated remote code execution and are already listed as actively exploited by CISA.
IPA is warning that two WordPress vulnerabilities, CVE-2026-60137 and CVE-2026-63030, can be chained together to achieve remote code execution without requiring administrator privileges on default configurations. The combined exploit chain has been named "wp2shell" by researchers. CVE-2026-60137 affects WordPress versions 6.8.0 through 6.8.5 as well as 6.9 and later, while CVE-2026-63030 affects 6.9 and later; versions prior to 6.8 are not impacted.
On July 21, 2026, CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog, confirming in-the-wild exploitation. Proof-of-concept exploit code has already been publicly released, raising the likelihood of broader exploitation. WordPress.org has enabled forced automatic updates for affected versions and released WordPress 6.8.6 as a fix for CVE-2026-60137, but IPA cautions that automatic updates may fail or be disabled in some environments, and recommends administrators manually verify and apply the update via the dashboard if needed.
Given WordPress's widespread use as a CMS platform, the unauthenticated nature of the exploit chain, and confirmed active exploitation with public PoC code, affected site operators should prioritize immediate patching or verification of automatic update status.
Mentioned in this report
Detection guidance
Web Server Process Spawning Command Shell After Possible WordPress Exploitation
Detects a web server/PHP worker process (as used by WordPress) spawning a shell or scripting interpreter, consistent with post-exploitation command execution following an unauthenticated RCE chain such as wp2shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Command Shell After Possible WordPress Exploitation
description: Detects PHP-FPM, Apache, Nginx or IIS worker processes spawning shell/scripting
interpreters. This is a common indicator of successful exploitation of a web application
vulnerability (e.g. the wp2shell WordPress RCE chain CVE-2026-60137/CVE-2026-63030)
resulting in command execution via the web server process.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \php-cgi.exe
- \php.exe
- \php-fpm.exe
- \httpd.exe
- \apache.exe
- \nginx.exe
- \w3wp.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \bash.exe
- \wscript.exe
- \cscript.exe
filter_known_admin_scripts:
CommandLine|contains:
- wp-cron.php
- wp-cli.phar
condition: selection and not filter_known_admin_scripts
falsepositives:
- WordPress plugins or cron jobs that legitimately shell out to system utilities
- Server management scripts that invoke PowerShell/cmd from PHP for maintenance tasks
level: high
id: 6aab6436-15c1-572a-8c1b-e74d54ebf839
status: experimental
author: Vorant
PHP Webshell File Written to WordPress Uploads or Plugin Directory
Detects creation of a PHP file inside wp-content/uploads or wp-content/plugins paths, consistent with a webshell dropped after exploiting an unauthenticated WordPress RCE vulnerability chain such as wp2shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP Webshell File Written to WordPress Uploads or Plugin Directory
description: Detects new .php files written into wp-content/uploads or wp-content/plugins
directories, which are not expected to normally contain executable PHP content uploaded
via the media/plugin upload flow. This pattern is typical of webshell placement
following exploitation of an unauthenticated WordPress vulnerability chain like
wp2shell (CVE-2026-60137/CVE-2026-63030).
tags:
- attack.initial-access
- attack.persistence
- attack.t1190
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- wp-content\uploads
- wp-content/uploads
TargetFilename|endswith: .php
filter_plugin_install:
TargetFilename|contains:
- wp-content\plugins
- wp-content/plugins
condition: selection and not filter_plugin_install
falsepositives:
- Legitimate plugins that store PHP helper scripts in custom upload subdirectories
- Site migration or backup tools that copy .php files into the uploads directory
level: high
id: b348495c-a659-5149-8c3a-44a8fa7f99c6
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2026/alert20260722.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free