Breaking: WordPress wp2shell RCE under mass exploitation — 22 July 2026
WordPress wp2shell: Unauthenticated RCE Under Active Mass Exploitation
Two WordPress Core vulnerabilities added to CISA's Known Exploited Vulnerabilities catalog on July 21 are being exploited in the wild at scale. Codenamed "wp2shell," the chain combines CVE-2026-63030 (REST API batch endpoint route confusion) with CVE-2026-60137 (WP_Query SQL injection via `author__not_in`) to achieve unauthenticated remote code execution on default WordPress installations. No plugins, no authentication, no preconditions.
CISA has assigned a three-day remediation deadline of July 24 for CVE-2026-63030, reflecting the urgency. WordPress 6.9.5 and 7.0.2 patch both flaws. Any site running 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1 is vulnerable.
Active Exploitation Escalating Rapidly
WatchTowr reports "tens of thousands of exploitation attempts" against honeypots following the release of public proof-of-concept code. KEVIntel has traced exploitation from 13 unique IPs across Switzerland, Germany, the UK, Indonesia, Lithuania, the Netherlands, and Singapore. Attackers are using blind, UNION-based, and Boolean-based SQL injection payloads matching publicly available exploit code.
Wiz estimates that 60% of organizations using WordPress had at least one vulnerable instance at disclosure, with 25% exposing a vulnerable server to the internet.
Post-Exploitation Activity Confirmed
Observed attacker behaviour includes deploying a 150 KB web shell disguised as the legitimate CMSmap plugin, which functions as a full attack platform with file management, database access, port scanning, batch code injection, and privilege escalation modules including MySQL UDF exploitation. Over 100 backdoor administrator accounts have been created across compromised sites. At least one threat actor has attempted to install Overlord RAT, a Golang-based remote access trojan. Credential exfiltration and local file inclusion targeting database credentials and authentication keys have also been observed.
Langflow RCE Also Added to KEV
In the same CISA batch, CVE-2026-0770 (Langflow Inclusion of Functionality from Untrusted Control Sphere) was added. This CVSS 9.8 vulnerability allows unauthenticated remote code execution on Langflow installations versions 1.0.0 through 1.10.0. CISA set a July 24 remediation deadline. BleepingComputer reports active exploitation against AI application servers. Patch to Langflow 1.9.0 or later.
So What / Action
For WordPress: Update to 7.0.2 or 6.9.5 immediately. If you cannot patch, enable persistent object caching (Redis or Memcached) to block the RCE path, and apply WAF rules to filter REST API batch endpoint abuse. After patching, audit for new administrator accounts, unfamiliar plugins (especially anything claiming to be CMSmap), and unexpected PHP files. Patching alone is not sufficient if exploitation predates the update.
For Langflow: Update to v1.9.0+ and review logs for unauthenticated API calls to code execution endpoints. Any internet-facing Langflow instance on an older version should be considered compromised until verified.
Both are three-day CISA deadlines. This is not a drill.