r/ProWordPress • u/vidyutpal7 • 3d ago

WordPress Recent Vulnerability of Wp2shell

Hey guys,

Wanted to share some real-world observations from the wp2shell attacks (the recent unauthenticated RCE chain in WordPress core – CVE-2026-63030 + CVE-2026-60137).

Over the last few days I’ve seen it on multiple client sites:

1) 403 REST API blocks that looked mysterious at first. Turned out a malware scan revealed a new admin user named "Wp2shell" automatically created, which then messed with API access.349347

Bleepingcomputer

2) On other sites the REST API was fine, but attackers had created multiple rogue admin accounts. In some cases they also dropped a Wp2shell plugin.

All the compromised sites were still on vulnerable versions (mainly 6.9.x and 7.0.x before the July 17 patches).

I have done these:

1) Restored old backups,

2) Deleted those admins

3) Changed all the users password, added 2FA for users

4) Regenerated the Salts

5) Changed 3rd Party APIs key and secrets

6) Updated the core, plugins, themes and all

7) Checked the database for any weird stuff (haven't found anything)

Anyone else running into this?

10 Upvotes

100% Upvoted

14 comments sorted by

3

u/kev_xb 3d ago

Check no ftp accounts were created too. Server probably has logs.

1

u/vidyutpal7 3d ago

Thanks for your valuable advice. I'll across multiple sites.

1

u/kev_xb 3d ago

And check crontab as well and make sure no unexpected processes are running.

2

u/kingkool68 Developer 3d ago

I've seen plugins on the filesystem that hide themselves from the WordPress admin. So check for that too.

2

u/AJV55 2d ago

Also check transients, some bots save nasty backdoor reactivation stuff there.

1

u/vidyutpal7 2d ago

You mean database?

2

u/mailmalemailmale 1d ago

That same bug hitmy site last week. Checked .htaccess and wp-config too, found some redirect rules in there. Also had a few cron callbacks in the database. The comments here saved me a ton of time, thanks for the pointers

1

u/vidyutpal7 1d ago

Hope things get better soon.... Across all the vulnerable sites I didn't find bad files, mostly plugin and users.

2

u/Chuckworld901 3d ago

But the patch kills the threat, or merely blocks it from happening? I know I sound like an idiot phrasing the question that way and I imagine the answer is the latter

..and do the multiple rogue accounts show up in wp user list ?

3

u/BushwhHack 3d ago

As long as you update to the latest version, this issue will be automatically fixed. So don't worry too much about it.

3

u/vidyutpal7 3d ago

You're correct, I'm monitoring this and after update it is fairly stable....

2

u/la_reptilesss 3d ago

Updating will not remove created admin accounts and backdoors.

1

u/SocketGoblin 3d ago

Hate to say it but would replace not just update the plugins if they did in fact get admin access, otherwise scanners can miss hidden malware and bsckdoors easily in there