Breaking: WordPress wp2shell & SharePoint RCE — Two Critical Exploits Under Active Attack — 27 July 2026

WordPress wp2shell: Pre-Auth RCE in Core, Mass Exploitation Confirmed

A pre-authentication remote code execution chain in WordPress Core is being actively exploited in the wild, with webshells deployed on compromised servers and mass scanning campaigns underway. The vulnerability pair, dubbed "wp2shell" (CVE-2026-63030 and CVE-2026-60137), affects every default WordPress installation running versions 6.9.0 through 7.0.1 without requiring plugins, authentication, or user interaction.

CVE-2026-63030 is a logic flaw in the WordPress REST API batch processor. When `wp_parse_url()` fails on a sub-request path, the error is pushed to the validation array but not the matches array, desynchronizing them. This causes every subsequent request to dispatch under the wrong handler, bypassing authorisation checks. CVE-2026-60137 is a SQL injection in the `author__not_in` parameter of the posts endpoint, which is normally protected by parameter validation. The batch API desynchronization bypasses that validation, enabling a UNION-based SQL injection. Chained together, the two flaws allow an unauthenticated attacker to create an administrator account, log in, and upload a malicious plugin for full code execution.

Wiz Research has confirmed active exploitation in cloud environments, observing malicious plugin uploads, user enumeration, local file inclusion targeting `wp-config.php` credentials, and admin panel access following successful batch API exploitation. Two categories of webshell have been identified: a minimal one-liner returning 404 as evasion, and a 150KB obfuscated full-featured attack platform disguised as a legitimate WordPress plugin. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on July 21, confirming active exploitation.

WordPress 6.9.5 and 7.0.2 fix the issue. Administrators should verify that every internet-facing WordPress instance has updated. Organisations that cannot patch immediately should block the `/wp-json/batch/v1` endpoint at the WAF, or disable anonymous REST API access. Even after patching, investigate for signs of compromise: review access logs for batch endpoint requests returning HTTP 207/200, check for unfamiliar plugins or PHP files, and audit admin accounts created since mid-July.

SharePoint CVE-2026-50522: Machine Key Theft Persists Past Patching

Microsoft SharePoint Server is under active exploitation via CVE-2026-50522 (CVSS 9.8), a deserialization vulnerability that enables unauthenticated remote code execution. Demonstrated live at Pwn2Own Berlin, the flaw was patched in July's Patch Tuesday. A public proof-of-concept released on July 20 triggered immediate exploitation: watchTowr's honeypot network captured compromise attempts within hours, and Defused Cyber confirmed unauthenticated attacks delivering .NET deserialization payloads through SharePoint sign-in endpoints.

The critical detail is persistence. Attackers are stealing SharePoint machine keys in a single request, enabling continued access even after the vulnerability itself is patched. Organisations that applied the Microsoft update but did not rotate machine keys and other exposed credentials remain compromised. CISA added CVE-2026-50522 to its KEV catalog on July 22 with a remediation deadline of July 25.

Patch immediately. Then rotate machine keys and any credentials that may have been exposed through the SharePoint server. Treat the patch as necessary but insufficient: any SharePoint instance that was unpatched between July 8 (Patch Tuesday) and now should be assumed compromised until key rotation and forensic review are complete.

So What

Two critical RCE vulnerabilities, both in widely deployed software, both under confirmed active exploitation, both added to CISA KEV in the past week. WordPress powers roughly 43% of the web. SharePoint is backbone infrastructure for thousands of enterprises. The WordPress situation is the more immediately urgent because the attack requires no credentials and the vulnerable code path exists in default installations, but the SharePoint machine key issue means that organisations which patched without rotating keys are likely still compromised.

If you run WordPress, verify patch levels now. If you run SharePoint on-premises, patch and then rotate keys. If you run both, this is the weekend those change windows were made for.