wp2root Chains WordPress RCE, PHP UAF, and Linux Copy Fail to Gain Root

Researchers published details of wp2root, an exploit chain that begins with AssetNote’s wp2shell pre-auth remote code execution in WordPress core and escalates limited PHP execution into full native code execution and ultimately Linux root on hardened hosts. The chain reportedly abuses a long-standing PHP Serializable/unserialize use-after-free flaw to obtain arbitrary memory read, discover live process addresses, and assemble a self-resolving ROP chain that bypasses restrictions such as disable_functions.

The final stage uses the 2026 Linux local privilege escalation dubbed Copy Fail to gain root without modifying files on disk. According to the report, the exploit launches an in-memory helper through memfd and execveat, then abuses the kernel page cache and /usr/bin/su to complete a fileless privilege escalation. The authors described the chain as a realistic demonstration of post-exploitation tradecraft against WordPress/PHP environments and said AI materially accelerated development of the multi-stage exploit.