WordPress Wp2shell Exploitation Tool User-Agent

calendar Jul 20, 2026 · attack.initial-access attack.t1190 cve.2026-63030 cve.2026-60137 detection.emerging-threats  ·
Share on: linkedin copy

Detects the hardcoded "wp2shell" User-Agent string used by the wp2shell PoC tool during all phases of CVE-2026-63030 and CVE-2026-60137 exploitation.

Sigma rule (View on GitHub)

 1title: WordPress Wp2shell Exploitation Tool User-Agent
 2id: a7c4e2f9-1b38-4d5c-9e72-3f4a5b6c7d8e
 3status: experimental
 4description: |
 5    Detects the hardcoded "wp2shell" User-Agent string used by the wp2shell
 6    PoC tool during all phases of CVE-2026-63030 and CVE-2026-60137 exploitation.    
 7references:
 8    - https://github.com/Icex0/wp2shell-poc
 9    - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
10    - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
11author: Swachchhanda Shrawan Poudel (Nextron Systems)
12date: 2026-07-19
13tags:
14    - attack.initial-access
15    - attack.t1190
16    - cve.2026-63030
17    - cve.2026-60137
18    - detection.emerging-threats
19logsource:
20    category: webserver
21detection:
22    selection:
23        cs-user-agent: 'wp2shell'
24    condition: selection
25falsepositives:
26    - Unlikely
27level: high

References

Related rules

to-top