Web Warning: Active Exploitation of WordPress "wp2shell" Core Vulnerabilities (CVE-2026-60137)
Executive Summary
A critical threat campaign dubbed wp2shell is actively targeting the global web ecosystem, exploiting two high-severity, unauthenticated vulnerabilities in the core architecture of the WordPress content management system. Tracked under CVE-2026-60137 and a companion identifier, the flaws allow unauthenticated remote attackers to bypass file-type validation filters, inject arbitrary PHP payloads directly into core directories, and execute remote code to achieve complete server takeover. Public exploit scripts are widely available, prompting security agencies and researchers to issue urgent alerts for immediate remediation.
Vulnerability Profile
Details
Target Software
WordPress Core (Vulnerable up to current patch release)
Vulnerability Identifiers
CVE-2026-60137 and companion CVE
Campaign Classification
wp2shell Automated Ingress and Backdoor Campaign
Severity Score
9.8 (Critical)
Remediation Action
Apply core updates and verify uploads directory integrity immediately
Technical Analysis of the wp2shell Vulnerabilities
The campaign exploits a structural logical weakness in how WordPress processes and sanitizes core file uploads and administrative metadata:
1. File Upload Filter Bypass (CVE-2026-60137)
* Vulnerability Class: Improper Control of Generation of Code (CWE-94) / Unrestricted Upload of File with Dangerous Type (CWE-434)
* Mechanics: The vulnerability lies within WordPress core's XML-RPC and REST API upload handlers. By sending a carefully crafted, multi-part HTTP POST request, attackers can exploit a sanitization flaw in the file-extension blacklist parser. By nesting double-extension prefixes and using specific null-byte injection patterns (e.g., payload.php.jpg), attackers trick the backend into writing an active PHP script directly to the /wp-content/uploads/ directory.
2. Path Traversal & Remote Code Execution (RCE)
* Vulnerability Class: Improper Limitation of a Pathname to a Restricted Directory (CWE-22)
* Mechanics: The companion vulnerability allows attackers to execute the uploaded script even if direct HTTP access to the /wp-content/uploads/ directory is blocked by server configuration. Attackers leverage a directory traversal flaw in the core template-include pipeline, passing a customized parameter that forces the server to load and execute the injected PHP file under the execution context of the web server (www-data).
Threat Landscape and Web Platform Risks
WordPress powers over 40% of the world's websites, making any core unauthenticated RCE vulnerability an extremely high-value target for cybercriminals and automated botnets. The wp2shell campaign is characterized by rapid, highly automated scanning. Within hours of the public exploit's release, botnets began launching mass-scanning operations targeting the /wp-json/ and xmlrpc.php endpoints of millions of domains.
Once compromised, these sites are integrated into malicious traffic distribution networks (TDS), used to host phishing templates, converted into search engine optimization (SEO) spam relays, or used as launchpads to conduct brute-force attacks against other high-value networks.
Recommendations and Mitigations
Site administrators must execute immediate defensive actions to secure their WordPress environments:
1. Deploy Cumulative Security Updates: Immediately update your WordPress core installation to the latest patched version. Enable automated security updates for all minor core releases.
2. Hard-Disable XML-RPC: If your site does not actively require external publishing tools, disable XML-RPC entirely by adding rules to your .htaccess or Nginx configuration, or utilizing a dedicated security plugin.
3. Restrict PHP Execution in Uploads Directories: Prevent the web server from executing any PHP files located inside the uploads directory. Add the following block to your /wp-content/uploads/.htaccess file:
deny from all
4. Implement a Web Application Firewall (WAF): Ensure your WAF is actively filtering incoming traffic for directory traversal patterns, null-byte payloads, and unauthorized multi-part file uploads targeting core WordPress directories.