Skip to content
vulnerabilityVulnerability Researchopen-source-security

Wp2shell: Wiz finds a pre-auth RCE chain in WordPress Core that plants persistent webshells

2 min read
Share

Wp2shell: Wiz finds a pre-auth RCE chain in WordPress Core that plants persistent webshells

WordPress Core has a critical pre-authentication remote code execution vulnerability, and attackers are already using it.

Wiz Research released findings on a vulnerability chain named wp2shell. Attackers can reach a vulnerable WordPress server with no credentials, execute arbitrary code, and leave a webshell behind before the server owner knows anything happened.

What wp2shell is

Wiz Research named the vulnerability chain wp2shell to describe its end-to-end impact: WordPress to shell, no authentication required. Multiple weaknesses in WordPress Core combine to let an unauthenticated attacker submit a crafted request, trigger server-side code execution, and write a persistent webshell to the server file system.

Webshells are files that give an attacker persistent access to the server through the web. Unlike other exploit payloads that run once and exit, a webshell stays in place. Attackers can return to it days or weeks later to execute commands, exfiltrate data, or pivot to connected systems.

Who is at risk

Any WordPress site running a vulnerable version of WordPress Core, if the server allows file writes from the web process. WordPress powers roughly 43 percent of all websites on the public internet. Even a small percentage of unpatched sites represents a large absolute target pool.

What attackers are doing with it

Wiz researchers confirmed active exploitation. Attackers are scanning for vulnerable WordPress installations and deploying webshells as a persistence mechanism. The speed of exploitation after a pre-auth RCE disclosure is typically measured in hours, not days.

What to do

Update WordPress Core to the latest version immediately. If you are on a hosting platform that handles WordPress updates automatically, verify the update was applied and check your file system for unexpected PHP files in the uploads or themes directories.

If you operate WordPress on a self-managed server, verify that the web server process does not have write access to directories outside of uploads. Restricting file write permissions limits what an attacker can do even if they achieve RCE.

Review your server logs for unexpected POST requests to WordPress core endpoints, particularly around wp-login.php and xmlrpc.php. Webshell access typically shows as GET or POST requests to unfamiliar PHP files.

Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your team needs help assessing WordPress security posture or hardening web application infrastructure.

Related articles

endpoint-securityCVEVulnerability Research

Apple warns iPhone users in 110 countries about mercenary spyware: what the Lock Screen notification means

Apple sent mercenary spyware threat notifications to iPhone users in 110 countries on August 13, 2026. For the first time, the alert appears as a push notification on the Lock Screen. Here is what these notifications mean, who receives them, and what to do if you get one.

CVEendpoint-securityVulnerability Research

ShieldBreak: Nightmare Eclipse bypasses Microsoft's Defender patch to hand you SYSTEM

A researcher released a working exploit that turns a patched Microsoft Defender privilege escalation into an unpatched SYSTEM escalation on fully patched Windows 11 and Server 2025. Here is what ShieldBreak does, who is affected, and what the patch timeline looks like.

CVEVulnerability Research

Lazarus and the kernel shortcut: CVE-2026-68820, FudModule, and Operation Dream Job

North Korea's Lazarus Group exploited a Windows WinSock zero-day for months before Microsoft patched it on August 11. Here is what they did with it, how the FudModule rootkit fits in, and why this pattern keeps repeating.