WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

wp2shell: WordPress RCE Chain Now Exploited at Scale

Security researchers have observed a dramatic increase in exploitation activity targeting a critical WordPress vulnerability chain dubbed wp2shell, which enables unauthenticated remote code execution on vulnerable sites. The release of a public proof-of-concept exploit has triggered mass internet scanning, as threat actors attempt to compromise WordPress installations at scale before administrators can patch.

What Is wp2shell?

wp2shell refers to an exploit chain combining two critical WordPress vulnerabilities that, when used together, allow an unauthenticated attacker to achieve full server compromise — essentially going from zero access to a web shell in a single attack sequence.

The chain involves:

1. Authentication bypass — bypassing WordPress authentication or exploiting a pre-auth flaw to gain elevated access
2. Remote code execution — leveraging the elevated access to execute arbitrary PHP code on the server

The "wp2shell" name reflects the end goal: WordPress to shell — complete server control through the WordPress installation.

Vulnerability Details

The availability of a public exploit dramatically accelerates the exploitation timeline. Once a working PoC is released, automated scanning tools incorporate the exploit within hours, and mass exploitation attempts begin across the entire internet within days.

How the Attack Works

1. Attacker scans internet for WordPress installations (via Shodan, Censys, or mass scanners)
2. Authentication bypass — attacker exploits flaw to gain admin-equivalent access
3. File write / code execution — abuses privileged access to write PHP webshell
4. Webshell access — attacker accesses uploaded shell via HTTP
5. Post-exploitation:
   - Database credential extraction (wp-config.php)
   - Defacement
   - Malware injection (SEO spam, cryptomining, redirects)
   - Data exfiltration
   - Lateral movement to other sites on shared hosting

Post-Exploitation Scenarios

Attackers who successfully exploit this chain typically pursue one or more of these goals:

Mass Scanning Context

When a public exploit drops for a widely-deployed platform like WordPress (used by 43% of all websites globally), the scanning response is immediate and massive:

• Automated scanners probe every internet-accessible WordPress instance
• Bot networks deploy the exploit across millions of URLs within hours
• Attack volume can exceed hundreds of thousands of exploitation attempts per hour across the internet

Shared hosting environments are particularly at risk — a successful exploitation on one site can pivot to other sites on the same server using file system access or database privilege escalation.

Immediate Steps for WordPress Administrators

1. Update WordPress Core Immediately

# Via WP-CLI
wp core update
 
# Verify version
wp core version

Or update through WordPress Admin → Dashboard → Updates.

2. Update All Plugins and Themes

If the vulnerability chain involves plugins, update everything:

# Update all plugins
wp plugin update --all
 
# Update all themes
wp theme update --all

3. Scan for Existing Compromise

# Check for recently modified PHP files (last 7 days)
find /path/to/wordpress/ -name "*.php" -mtime -7 -type f
 
# Look for webshell indicators
grep -rl "eval\s*(base64_decode" /path/to/wordpress/
grep -rl "system\s*(" /path/to/wordpress/wp-content/uploads/
grep -rl "\$_REQUEST\[" /path/to/wordpress/wp-content/uploads/
 
# Verify WordPress core file integrity
wp core verify-checksums

4. Review User Accounts

# List all WordPress admin accounts
wp user list --role=administrator
 
# Check for recently created users
wp user list --orderby=registered --order=DESC

5. Deploy a WAF

A Web Application Firewall can block exploitation attempts even before patching:

• Wordfence (free and premium) — WordPress-specific WAF with virtual patching
• Cloudflare WAF — blocks common WordPress attack patterns at the edge
• Sucuri — website security platform with WAF and malware scanning

# Install Wordfence via WP-CLI
wp plugin install wordfence --activate

6. Harden File Permissions

# Correct WordPress file permissions
find /path/to/wordpress/ -type f -exec chmod 644 {} \;
find /path/to/wordpress/ -type d -exec chmod 755 {} \;
 
# Restrict wp-config.php
chmod 600 /path/to/wordpress/wp-config.php
 
# Make uploads non-executable (prevent PHP webshell execution)
# Add to .htaccess in wp-content/uploads/:
# <FilesMatch "\.php$">
#   deny from all
# </FilesMatch>

Detection Indicators

Why WordPress Is a Persistent Target

WordPress's ubiquity makes it the highest-value target in web security:

• 43%+ of the web runs WordPress
• Thousands of third-party plugins create a vast attack surface
• Many installations are unmaintained or running outdated versions
• Shared hosting amplifies the blast radius of successful compromise

Public exploits for WordPress vulnerabilities routinely trigger some of the largest coordinated web scanning campaigns observed by security researchers.

References

• The Hacker News — WordPress wp2shell Exploitation Grows
• Wordfence Threat Intelligence
• WPScan WordPress Vulnerability Database

Related Reading

• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• CVE-2024-51311: Critical Stack Overflow in Tenda TX9 Router Firmware
• Critical Palo Alto VPN Bug Now Exploited by Qilin Ransomware Gang