# WordPress "wp2shell" RCE bug added to CISA KEV

Published: 2026-07-21 · Severity: high
Canonical: https://vorant.io/reports/e6912209-2da4-5ea1-99a4-e1f7b80b5302/wordpress-wp2shell-rce-bug-added-to-cisa-kev

> Two chained WordPress vulnerabilities, dubbed wp2shell, enable unauthenticated remote code execution and are already listed as actively exploited by CISA.

IPA is warning that two WordPress vulnerabilities, CVE-2026-60137 and CVE-2026-63030, can be chained together to achieve remote code execution without requiring administrator privileges on default configurations. The combined exploit chain has been named "wp2shell" by researchers. CVE-2026-60137 affects WordPress versions 6.8.0 through 6.8.5 as well as 6.9 and later, while CVE-2026-63030 affects 6.9 and later; versions prior to 6.8 are not impacted.

On July 21, 2026, CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog, confirming in-the-wild exploitation. Proof-of-concept exploit code has already been publicly released, raising the likelihood of broader exploitation. WordPress.org has enabled forced automatic updates for affected versions and released WordPress 6.8.6 as a fix for CVE-2026-60137, but IPA cautions that automatic updates may fail or be disabled in some environments, and recommends administrators manually verify and apply the update via the dashboard if needed.

Given WordPress's widespread use as a CMS platform, the unauthenticated nature of the exploit chain, and confirmed active exploitation with public PoC code, affected site operators should prioritize immediate patching or verification of automatic update status.

## Mentioned in this report

- Vulnerabilities: CVE-2026-60137 (KEV), CVE-2026-63030 (KEV)
- Campaigns: wp2shell

## Detection guidance (public sample)

### Web Server Process Spawning Command Shell After Possible WordPress Exploitation

ATT&CK: T1190

Detects a web server/PHP worker process (as used by WordPress) spawning a shell or scripting interpreter, consistent with post-exploitation command execution following an unauthenticated RCE chain such as wp2shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Spawning Command Shell After Possible WordPress Exploitation
description: Detects PHP-FPM, Apache, Nginx or IIS worker processes spawning shell/scripting
  interpreters. This is a common indicator of successful exploitation of a web application
  vulnerability (e.g. the wp2shell WordPress RCE chain CVE-2026-60137/CVE-2026-63030)
  resulting in command execution via the web server process.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \php-cgi.exe
    - \php.exe
    - \php-fpm.exe
    - \httpd.exe
    - \apache.exe
    - \nginx.exe
    - \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \bash.exe
    - \wscript.exe
    - \cscript.exe
  filter_known_admin_scripts:
    CommandLine|contains:
    - wp-cron.php
    - wp-cli.phar
  condition: selection and not filter_known_admin_scripts
falsepositives:
- WordPress plugins or cron jobs that legitimately shell out to system utilities
- Server management scripts that invoke PowerShell/cmd from PHP for maintenance tasks
level: high
id: 6aab6436-15c1-572a-8c1b-e74d54ebf839
status: experimental
author: Vorant
```

### PHP Webshell File Written to WordPress Uploads or Plugin Directory

ATT&CK: T1190

Detects creation of a PHP file inside wp-content/uploads or wp-content/plugins paths, consistent with a webshell dropped after exploiting an unauthenticated WordPress RCE vulnerability chain such as wp2shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PHP Webshell File Written to WordPress Uploads or Plugin Directory
description: Detects new .php files written into wp-content/uploads or wp-content/plugins
  directories, which are not expected to normally contain executable PHP content uploaded
  via the media/plugin upload flow. This pattern is typical of webshell placement
  following exploitation of an unauthenticated WordPress vulnerability chain like
  wp2shell (CVE-2026-60137/CVE-2026-63030).
tags:
- attack.initial-access
- attack.persistence
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - wp-content\uploads
    - wp-content/uploads
    TargetFilename|endswith: .php
  filter_plugin_install:
    TargetFilename|contains:
    - wp-content\plugins
    - wp-content/plugins
  condition: selection and not filter_plugin_install
falsepositives:
- Legitimate plugins that store PHP helper scripts in custom upload subdirectories
- Site migration or backup tools that copy .php files into the uploads directory
level: high
id: b348495c-a659-5149-8c3a-44a8fa7f99c6
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2026/alert20260722.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e6912209-2da4-5ea1-99a4-e1f7b80b5302/wordpress-wp2shell-rce-bug-added-to-cisa-kev.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup