Loading story…
Researchers published details of wp2root, an exploit chain that begins with AssetNote’s wp2shell pre-auth remote code execution in WordPress core and escalates limited PHP execution into full native code execution and ultimately Linux root on hardened hosts. The chain reportedly abuses a long-standing PHP Serializable/unserialize use-after-free flaw to obtain arbitrary memory read, discover live process addresses, and assemble a self-resolving ROP chain that bypasses restrictions such as disable_functions.
The final stage uses the 2026 Linux local privilege escalation dubbed Copy Fail to gain root without modifying files on disk. According to the report, the exploit launches an in-memory helper through memfd and execveat, then abuses the kernel page cache and /usr/bin/su to complete a fileless privilege escalation. The authors described the chain as a realistic demonstration of post-exploitation tradecraft against WordPress/PHP environments and said AI materially accelerated development of the multi-stage exploit.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
A Rapid7 Metasploit pull request proposed a non-destructive auxiliary scanner module to detect WordPress REST API Batch Route Confusion and blind SQL injection exposure associated with CVE-2026-63030 and a second referenced CVE. The module supports single-target and batch scanning, optional SQL injection timing confirmation, and an optional Cloudflare WAF bypass setting.
COLCERT issued alert AL – 20260805 - 109 describing a critical WordPress vulnerability referred to as the "wp2shell" chain. The available reference identifies WordPress as the affected product but does not provide CVE, affected versions, or mitigation details.
Calif published "The WordPress Chain Massacre," detailing the wp2root post-exploitation chain from WordPress compromise through PHP escape to Linux root and framing it as a realistic hardened-host tradecraft demonstration.
The final stage invokes the 2026 Linux local privilege escalation dubbed "Copy Fail," using an in-memory helper executed via memfd and execveat to overwrite the page-cache copy of /usr/bin/su and obtain root without changing the on-disk binary.
Using leaked live code pointers and runtime parsing of the loaded PHP image, the exploit builds a self-resolving ROP chain, pivots execution through corrupted array bookkeeping, and launches position-independent shellcode.
The exploit chain uses an old PHP legacy Serializable/unserialize use-after-free bug to turn constrained PHP execution into arbitrary memory read, recover live addresses, and bypass restrictions such as disable_functions.
The referenced chain starts from AssetNote's "wp2shell," described as a pre-auth WordPress core remote code execution path that can let an unauthenticated attacker execute PHP code and create an administrator for plugin upload.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
11 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcecyberveille.ch
Open sourcemalware.news
Open sourceblog.calif.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcebtcirt.bt
Open sourcegovcert.bg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WordPress released **7.0.2** to fix two core vulnerabilities that can be chained into unauthenticated remote code execution, including **CVE-2026-63030** and **CVE-2026-60137**. The flaws affect default WordPress installations without plugins, with the RCE path impacting **6.9.0 through 6.9.4**, **7.0.0 through 7.0.1**, and **7.1 beta**, while the SQL injection issue also affects the **6.8** branch. WordPress issued backported fixes in **6.9.5**, **6.8.6**, and **7.1 Beta 2**, enabled forced auto-updates for affected sites, and said the attack chain abuses the REST API batch endpoint to trigger route confusion, bypass request handling restrictions, and reach SQL injection that can lead to full site compromise. Security vendors moved quickly to contain exposure as public technical details began to emerge. Cloudflare deployed WAF protections for both CVEs for all customers and Wordfence added firewall coverage for premium users, but both stressed that filtering is only a temporary mitigation and that patching is the primary remediation. Researchers attributed the discovery to Adam Kues of Searchlight Cyber's Assetnote team, and while early reporting said no in-the-wild exploitation had been confirmed, a public GitHub proof of concept later demonstrated unauthenticated access to the vulnerable batch endpoint and blind SQL injection against affected versions, increasing the likelihood of rapid attacker weaponization.
Aug 26, 2026
WordPress released security updates for two core vulnerabilities, **CVE-2026-63030** and **CVE-2026-60137**, that can be chained to make a blind SQL injection remotely reachable without authentication and, in some cases, lead to **remote code execution**. The issue, dubbed **`wp2shell`**, stems from REST API batch-route confusion in the `/wp-json/batch/v1` endpoint combined with SQL injection, affecting WordPress versions **6.9.0 through 6.9.4** and **7.0.0 through 7.0.1**. Researchers said the route-confusion flaw carries a **CVSS 9.8** rating, while the second SQL injection bug is rated **CVSS 5.9**. WordPress fixed the flaws in **6.9.5** and **7.0.2**, and also backported the SQL injection fix to **6.8.6**. The vulnerabilities were reported by Adam Kues of Assetnote through the WordPress HackerOne program, and while exploitation had not been confirmed at the time of disclosure, a public proof of concept later became available, increasing the risk of rapid weaponization. Administrators were urged to verify that forced automatic updates succeeded and, if immediate patching was not possible, to apply mitigations such as blocking the REST batch endpoint with a WAF.
Jul 31, 2026
Researchers reported attackers are hiding malicious PHP code in WordPress sites’ `mu-plugins` directory, a location that loads plugins automatically and is often overlooked because entries do not appear in the standard administrative plugin view. In one observed intrusion, a file named `wp-index.php` in `wp-content/mu-plugins/` fetched a second-stage payload from a `ROT13`-obfuscated URL, giving the attacker persistent access and the ability to execute remote PHP code on the compromised server. Additional infections linked to the same technique included redirects to fake update pages, website defacement or content replacement, and webshell deployment. The reported impact ranges from remote code execution and privilege escalation to denial of service and full site compromise, prompting defenders to audit the `mu-plugins` folder, review indicators of compromise, keep WordPress components updated, enforce proper file permissions, and disable in-dashboard file editing in `wp-config.php`.
Aug 14, 2026