PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Exploitation in the Wild of wp2shell

wiz.io | blog | #rce | #wordpress | #vulnerability | #webshell | #cve-2026-63030 | #cve-2026-60137 | #exploit-in-the-wild
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz Research observed in-the-wild exploitation of wp2shell, a pre-auth RCE chain in WordPress Core (CVE-2026-63030, CVE-2026-60137), used to install persistent webshells and backdoor plugins.
Published
Collected

Related coverage

blog · hacktron.ai
Could Modern Code Review Have Prevented wp2shell?
We recreated the WordPress pull requests behind CVE-2026-63030 and CVE-2026-60137 to test whether today's code reviewers and SAST tools would catch both vulnerabilities.
vulnerability · netspi.com
CVE-2026-63030 & CVE-2026-60137: WordPress Core Pre-Authentication RCE Overview & Takeaways
The wp2shell chain pairs REST API route confusion (CVE-2026-63030) with WP_Query SQL injection (CVE-2026-60137) for unauthenticated full RCE on WordPress Core, now actively exploited in the wild.
blog · netspi.com
Getting Shells at Terminal Velocity with Wopper
Wopper is a NetSPI tool that automates WordPress code execution from admin credentials: it uploads, executes, obfuscates, and self-deletes PHP files in seconds, replacing manual plugin upload steps.
vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Critical · vulnerability · github.com
CVE-2026-111497: Unauthenticated WordPress RCE Exploit Chain PoC via Brotli Decoder Flaw
Demonstrates a reliable, real-world weaponization of the Brotli decoder memory corruption flaw in web application environments without requiring information leaks or debugging instrumentation. Highlights the critical risk of untrusted compressed streams in server-side HTTP clients.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
Back