Critical wp2shell WordPress Flaws (CVE‑2026‑63030, CVE‑2026‑60137) Enable Unauthenticated Webshell Installations
What It Is — A pair of critical vulnerabilities in WordPress core (CVE‑2026‑63030 and CVE‑2026‑60137) allow remote attackers to abuse the REST API’s batch‑processing endpoint and execute arbitrary PHP code without authentication. The exploit chain is used to drop persistent webshells and malicious plugins on compromised sites.
Exploitability — Public proof‑of‑concept exploits appeared within days of disclosure; active exploitation has been confirmed by multiple security firms. CVSS v3.1 scores are 9.8 (Critical) for both CVEs.
Affected Products — WordPress core installations prior to the patched releases: 7.0.2, 6.9.5, and 6.8.6 (all supported versions).
Why It Matters for Compliance & Audit Readiness
- Control Mapping – SOC 2 CC6.1 (System Operations) requires documented evidence that critical software patches are applied promptly; the rapid exploitation shows the risk of lagging patch cycles.
- Continuous Evidence – Real‑time monitoring of plugin uploads and file integrity provides audit‑ready logs that demonstrate due diligence to regulators and enterprise customers.
- Access Controls – Unauthenticated code execution violates CC6.2 (Change Management) and CC7.1 (Logical Access); remediation must be reflected in your control framework to maintain trust.
Recommended Actions
- Verify your WordPress version and upgrade immediately to 7.0.2, 6.9.5, or 6.8.6 (or later).
- Enforce application‑level WAF rules that block abusive REST‑API batch requests.
- Deploy continuous file‑integrity monitoring on the
/wp‑content/directory to alert on unexpected webshell files. - Restrict plugin upload capabilities to vetted, signed packages and require multi‑factor approval for changes.
- Capture patch‑deployment and monitoring logs as SOC 2 evidence of timely remediation.
Source: BleepingComputer – Critical wp2shell WordPress flaws exploited to install webshells