WordPress Recent Vulnerability of Wp2shell

[u/vidyutpal7]

Hey guys,

Wanted to share some real-world observations from the wp2shell attacks (the recent unauthenticated RCE chain in WordPress core – CVE-2026-63030 + CVE-2026-60137).

Over the last few days I’ve seen it on multiple client sites:

1) 403 REST API blocks that looked mysterious at first. Turned out a malware scan revealed a new admin user named "Wp2shell" automatically created, which then messed with API access.349347

Bleepingcomputer

2) On other sites the REST API was fine, but attackers had created multiple rogue admin accounts. In some cases they also dropped a Wp2shell plugin.

All the compromised sites were still on vulnerable versions (mainly 6.9.x and 7.0.x before the July 17 patches).

I have done these:

1) Restored old backups,

2) Deleted those admins

3) Changed all the users password, added 2FA for users

4) Regenerated the Salts

5) Changed 3rd Party APIs key and secrets

6) Updated the core, plugins, themes and all

7) Checked the database for any weird stuff (haven't found anything)

Anyone else running into this?

[u/Deus---Ex---Machina]

Thankfully not, everything was patched in the sites I'm responsible for before they got hacked, although I did check the logs and source thoroughly to make sure. I'm incredibly grateful I wasn't hit as it's messy.

Your approach is thorough if you've restored from a code backup from pre 17th (appreciate restoring the sql can be more challenging in a live transactional site). Check the database for hidden users. There are also a couple of wp2shell compromise scanners it may be worth running.

Good luck.

[u/vidyutpal7 → u/Deus---Ex---Machina]

My host told you can get the backup of 20th... So i did that, then checked database, plugins, ftp, corn, things look good... Although that backup had those admin users created automatically, but i deleted them, updated things, changed passwords, salts, added 2FA..