WordPress Core “wp2shell” Vulnerability Enables RCE and Malicious Visitor Redirection
What Happened — A chain of flaws in WordPress core, dubbed wp2shell, allows unauthenticated remote code execution and full site takeover. Attackers can inject malicious JavaScript, fake login forms, or drive‑by downloads that affect any visitor to the compromised site. Exploitation began within hours of the patch release, and proof‑of‑concept code is publicly available.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the risk of unpatched software—a control gap that SOC 2 auditors scrutinize under Change Management (CC6.1) and Risk Management (CC7.1).
- Highlights the need for continuous vulnerability monitoring and evidence‑driven patch cycles to prove due diligence.
- Shows how a single unaddressed flaw can cascade into data‑exfiltration or credential theft for downstream users, impacting the organization’s third‑party risk posture.
Who Is Affected — All industries that host public‑facing WordPress sites (media, e‑commerce, education, SaaS, government, etc.).
Recommended Actions
- Integrate automated WordPress version scanning into your continuous compliance platform.
- Map the patch‑management process to SOC 2 control CC6.1 and retain evidence of remediation timestamps.
- Deploy real‑time web‑application firewalls (WAF) and endpoint protection that can block malicious redirects. Source: Malwarebytes Labs
Technical Notes — The wp2shell chain exploits a core PHP deserialization flaw and an unauthenticated SQL injection, leading to remote code execution with web‑server privileges. Attackers inject JavaScript or iframes that harvest credentials, deliver malware, or redirect users to phishing sites. Source: Malwarebytes Labs