WordPress Wp2shell Webshell Plugin Access

title: WordPress Wp2shell Webshell Plugin Access
id: c9e6f412-3d50-4f7e-bf94-5b6c7d8e9f0a
status: experimental
description: |
    Detects post-exploitation access to the wp2shell webshell plugin dropped after successful
    exploitation of CVE-2026-63030 and CVE-2026-60137. After the pre-auth SQLi-to-admin bridge is established,
    the attacker can upload a malicious plugin (wp2shell) to the target WordPress instance.
    At this phase, the attacker accesses the webshell for command execution and persistence.
references:
    - https://github.com/Icex0/wp2shell-poc
    - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
    - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-07-19
tags:
    - attack.execution
    - attack.persistence
    - attack.t1505.003
    - cve.2026-63030
    - cve.2026-60137
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        cs-uri-stem|contains: '/wp-content/plugins/wp2shell_'
    filter_optional_null_query:
        cs-uri-query: null
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - Unlikely
level: critical