WordPress Wp2shell Webshell Plugin Access

calendar Jul 20, 2026 · attack.execution attack.persistence attack.t1505.003 cve.2026-63030 cve.2026-60137 detection.emerging-threats  ·
Share on: linkedin copy

Detects post-exploitation access to the wp2shell webshell plugin dropped after successful exploitation of CVE-2026-63030 and CVE-2026-60137. After the pre-auth SQLi-to-admin bridge is established, the attacker can upload a malicious plugin (wp2shell) to the target WordPress instance. At this phase, the attacker accesses the webshell for command execution and persistence.

Sigma rule (View on GitHub)

 1title: WordPress Wp2shell Webshell Plugin Access
 2id: c9e6f412-3d50-4f7e-bf94-5b6c7d8e9f0a
 3status: experimental
 4description: |
 5    Detects post-exploitation access to the wp2shell webshell plugin dropped after successful
 6    exploitation of CVE-2026-63030 and CVE-2026-60137. After the pre-auth SQLi-to-admin bridge is established,
 7    the attacker can upload a malicious plugin (wp2shell) to the target WordPress instance.
 8    At this phase, the attacker accesses the webshell for command execution and persistence.    
 9references:
10    - https://github.com/Icex0/wp2shell-poc
11    - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
12    - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
13author: Swachchhanda Shrawan Poudel (Nextron Systems)
14date: 2026-07-19
15tags:
16    - attack.execution
17    - attack.persistence
18    - attack.t1505.003
19    - cve.2026-63030
20    - cve.2026-60137
21    - detection.emerging-threats
22logsource:
23    category: webserver
24detection:
25    selection:
26        cs-uri-stem|contains: '/wp-content/plugins/wp2shell_'
27    filter_optional_null_query:
28        cs-uri-query: null
29    condition: selection and not 1 of filter_optional_*
30falsepositives:
31    - Unlikely
32level: critical

References

Related rules

to-top