cve.2026-60137

WordPress Wp2shell Exploitation Tool User-Agent

Jul 20, 2026 · attack.initial-access attack.t1190 cve.2026-63030 cve.2026-60137 detection.emerging-threats ·

Detects the hardcoded "wp2shell" User-Agent string used by the wp2shell PoC tool during all phases of CVE-2026-63030 and CVE-2026-60137 exploitation.

WordPress Wp2shell REST Batch Endpoint Exploitation

Jul 20, 2026 · attack.initial-access attack.t1190 detection.emerging-threats cve.2026-63030 cve.2026-60137 ·

Share on:

Detects exploitation attempts against the WordPress REST batch endpoint (CVE-2026-63030, CVE-2026-60137) using the wp2shell PoC tool. The tool sends POST requests to the batch endpoint via the ?rest_route=/batch/v1 query parameter, covering all attack phases from initial probe through SQL injection and pre-auth admin creation. A 207 response confirms the endpoint is active on the target.

WordPress Wp2shell Webshell Plugin Access

Jul 20, 2026 · attack.execution attack.persistence attack.t1505.003 cve.2026-63030 cve.2026-60137 detection.emerging-threats ·

Share on:

Detects post-exploitation access to the wp2shell webshell plugin dropped after successful exploitation of CVE-2026-63030 and CVE-2026-60137. After the pre-auth SQLi-to-admin bridge is established, the attacker can upload a malicious plugin (wp2shell) to the target WordPress instance. At this phase, the attacker accesses the webshell for command execution and persistence.