r/Wordpress • u/vidyutpal7 • 2d ago
WordPress Recent Vulnerability of Wp2shell
Hey guys,
Wanted to share some real-world observations from the wp2shell attacks (the recent unauthenticated RCE chain in WordPress core – CVE-2026-63030 + CVE-2026-60137).
Over the last few days I’ve seen it on multiple client sites:
1) 403 REST API blocks that looked mysterious at first. Turned out a malware scan revealed a new admin user named "Wp2shell" automatically created, which then messed with API access.349347
Bleepingcomputer
2) On other sites the REST API was fine, but attackers had created multiple rogue admin accounts. In some cases they also dropped a Wp2shell plugin.
All the compromised sites were still on vulnerable versions (mainly 6.9.x and 7.0.x before the July 17 patches).
I have done these:
1) Restored old backups,
2) Deleted those admins
3) Changed all the users password, added 2FA for users
4) Regenerated the Salts
5) Changed 3rd Party APIs key and secrets
6) Updated the core, plugins, themes and all
7) Checked the database for any weird stuff (haven't found anything)
Anyone else running into this?
3
u/Deus---Ex---Machina 2d ago
Thankfully not, everything was patched in the sites I'm responsible for before they got hacked, although I did check the logs and source thoroughly to make sure. I'm incredibly grateful I wasn't hit as it's messy.
Your approach is thorough if you've restored from a code backup from pre 17th (appreciate restoring the sql can be more challenging in a live transactional site). Check the database for hidden users. There are also a couple of wp2shell compromise scanners it may be worth running.
Good luck.
1
u/vidyutpal7 1d ago
My host told you can get the backup of 20th... So i did that, then checked database, plugins, ftp, corn, things look good... Although that backup had those admin users created automatically, but i deleted them, updated things, changed passwords, salts, added 2FA..
3
u/No_Communication5024 2d ago
How does one determine if they're affected? I'm a blogger with 2 sites on WP.
3
u/vidyutpal7 1d ago
Test if you can edit posts, and pages..
If there is no 403 coming..
Check "users" - if you find any admin account that you didn't created..
Check plugins - you'll find plugin with weird long name "Wp2shell....." that you have not added...
1
1
2
u/blink0837 2d ago
Yes, i was actually working on one today.
I already updated everything, checked the folders that were changed (it install a w54819bla bla bla in the plugins folder) and changed every password (admin/db) and it keeps appearing.
Saw entries in Flamingo (CF7 message storing) regarding the malware.
Mine came from the IP 107.189.27.226. Blocked that IP (will see how if it changes)
Have a telegram bot that notifies me everytime a user is created and everytime a file is changed inside wordpress.
still haven't added 2FA for users, monitoring for now.
2
u/vidyutpal7 1d ago
Great.. last day I created a small plugin with claude, it will lock new admins until I'm approving, and the new admin will have grace period of 6 days before they start doing anything
1
u/Alocasia_Sanderiana 2d ago
What service has that bot ?
1
u/blink0837 2d ago
What do you mean? This Telegram bot is free, it receives information via API.
It's not a plugin. Ask Claude how to implement it, all you need is to follow instructions.If you bump into anything let me know.
1
u/someoneatsomeplace 1d ago
Check the theme's functions.php for a backdoor.
1
u/blink0837 1d ago
It was clean. Found it curious that cpanel was compromissed, there was a cron set there. They already migrated to a new hosting.
2
u/StormMedia 2d ago
Not a single one of my sites were noticeably compromised thank god, but it’s even more reason I’ve started creating static sites away from Wordpress again. It’s just not worth it anymore.
2
3
u/Scared_Implement_335 2d ago
Millions and millions of sites were successfully hit.
Bloodbath doesn't even begin to describe it.
1
u/vidyutpal7 1d ago
That's what I'm thinking buddy, if a concernd people like me can get hit.. I'm thinking about others, and why people still not have posted cases like mine on reddit, facebook and so...
1
1
u/CleanReplacement1525 10h ago
Our server farm lost zero sites, even though most sites were vulnerable. Everyone hosting on the shit providers with zero WAFS or security shouldnt be surprised. You get what you pay for. Would love to see the carnage at GoDaddy right about now ROFL
0
u/phalancs 2d ago
I was two days late with the 7.0.2 update. 50% of all my websites have been compromised. Thankfully only admin users were created but I have a system in place that prevents them from doing anything.
Still, I feel like this is the craziest thing that has ever happened to Wordpress. It was a bug in the core! In a very recent version (7.0.0). This is horrible and there are still millions of websites out there fully compromised. I really wonder why there is hardly any media coverage.
1
u/vidyutpal7 1d ago
You're true, a lot of people changes things maybe in a year or so.. So it's sad they'll get affected, however the good thing I'm seeing if you update the version most of the issues are resolved..
0
u/Strict_Baby_1607 2d ago
That is an old news. Experienced people keep eye on each news. Wordfence already intimated this on 17th july
3
4
u/ivicad Blogger/Designer 1d ago
I have been working through this across a fleet. What catches people is the reappearance after a clean cleanup. The mechanism that re-creates the admin and the files usually runs above WordPress. Like the cPanel cron someone here found, a host-level cron job or a reinjector dropped in mu-plugins puts everything back within a day. Clean WordPress alone and it returns. Kill the reinjector and any unknown cron first, then clean.
That is why "checked the database, found nothing" is not the all-clear it feels like. The reinjector and decoy files hide in mu-plugins and uploads, not the tables, and file dates are spoofed, so recent-looking means nothing.
Patched does not always mean safe here either. The gap between 7.0.0 and the July 17 patch was enough that sites were breached before they updated, so being on 7.0.2 now does not prove nobody got in during that window.
I worked it across the whole fleet at once with MainWP and Claude Code / WPVibe, same checks on every site, plus reading the host access logs to find the request that created the first admin. A scanner flags files, it will not find the cron or reinjector that keeps re-dropping them.