Loading malware…
wp2shell is an internally developed Python exploitation package used by CyberXero, a Russian-speaking, financially motivated initial access broker, to compromise internet-facing WordPress installations. The name also denotes the WordPress Core vulnerability chain involving CVE-2026-63030 and CVE-2026-60137, rather than a distinct webshell family. The chain combines REST API batch-processing route confusion with SQL injection to enable unauthenticated compromise without requiring a vulnerable plugin, theme, or existing login.
The package abuses desynchronization between route validation and execution to bypass input sanitization, inject SQL, create an unauthorized administrator account, and deploy a WSO-family webshell registered as an active WordPress plugin. This provides remote code execution with web-server privileges and persistent access through the malicious plugin and administrator account. CyberXero incorporated wp2shell into automated, opportunistic intrusion workflows targeting WordPress sites worldwide.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Its internal wp2shell package abused the WordPress REST API batch endpoint to inject SQL, create a rogue administrator and install a WSO-family webshell.
À partir du 20 juillet 2026, l’acteur a exploité la chaîne wp2shell (CVE-2026-63030 + CVE-2026-60137) contre 49 organisations dans 29 pays.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Weaponization of CVE-2026-63030, CVE-2026-4815, CVE-2015-1397 within 30 days of disclosure
The related WordPress activity reportedly stole "comptes admin WP, credentials," while the Gitea activity involved persistent access; the supplied TTP list identifies T1078.
wp2shell against WordPress REST API; blind SQLi, CVE-2026-4815, and WAF bypass against further targets
For ordinary command mode, evaluate a passthru(base64_decode(...)) snippet.
httpd, apache2, or php-fpm spawning a shell and running short discovery commands (sh -c id is a common first confirmation).
That final authenticated administration step turns the core pre-auth primitive into PHP evaluation and OS command execution.
The related WordPress activity reportedly stole "comptes admin WP, credentials," while the Gitea activity involved persistent access; the supplied TTP list identifies T1078.
The WordPress campaign reportedly involved "création de compte admin," and the supplied TTP list identifies T1136.
Rogue administrators following the wp2_ pattern on compromised WordPress installs
With ordinary stock file-modification permissions, that account can upload a plugin containing a directly requestable PHP endpoint.
T1505.001 — Server Software Component: SQL Stored Procedures (Persistence)
WSO and wp2shell webshells; wp2shell registered as an active WordPress plugin
The related WordPress activity reportedly stole "comptes admin WP, credentials," while the Gitea activity involved persistent access; the supplied TTP list identifies T1078.
The related WordPress activity reportedly stole "comptes admin WP, credentials," while the Gitea activity involved persistent access; the supplied TTP list identifies T1078.
Pré-authentification : injection SQL aveugle basée sur le temps pour extraire le couple user_login:user_pass (hash) depuis la table wp_users . Post-authentification : utilisation des credentials récupérés (après crackage offline du hash)
T1552.001 — Unsecured Credentials: Credentials In Files (Credential Access)
The command-execution alerts show /usr/sbin/apache2 as the parent and /usr/bin/dash running sh -c -- id, whoami, and hostname.
Generally, a PoC invocation introduces command lines the host has never seen: compound discovery strings, recon one-liners with uname and find.
From a fresh webshell, reconnaissance commands including SUID enumeration (find / -perm -u=s -type f).
T1071.001 — Application Layer Protocol: Web Protocols (Command and Control)
Telegram bot used as a real-time operational notification channel
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.