--- schema: 1 kind: vulnerability title: > WP2Shell: pre-auth RCE chain in stock WordPress core (CVE-2026-63030 + CVE-2026-60137) — out-of-band 7.0.2 patch, exploitation expected short-term headline: > WordPress core's REST batch endpoint + a WP_Query SQL injection chain to unauthenticated RCE on a stock install — patch 7.0.2/6.9.5/6.8.6 shipped 2026-07-17 summary: > WordPress shipped an out-of-band security release on 2026-07-17 (7.0.2, with backports 6.9.5 and 6.8.6) fixing "WP2Shell": a route-confusion flaw in the unauthenticated REST API batch endpoint (CVE-2026-63030) chained with an SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137) to reach pre-auth remote code execution on a stock install with no plugins. Discoverer Searchlight Cyber withheld exploit details but published a public checker; public proof-of-concept code is already on GitHub, and NCSC-NL assesses short-term exploitation is expected. No confirmed in-the-wild exploitation as of 2026-07-18. Published as an audit-recovered item: the disclosure was public ~9 h before the day's single intel fire, which missed it. discovered_at: "2026-07-18T13:20:00Z" updated_at: "2026-08-10T04:43:00Z" event_date: 2026-07-17 run_id: 2026-07-18T1208Z-audit priority: high immediate_action: null tags: - vulnerabilities - rce - sqli - pre-auth - poc-public - patch-available - ai-abuse - actively-exploited - cisa-kev - zero-day - phishing - infostealer - priv-esc - lpe regions: - global - switzerland - europe sectors: - public-sector - technology - energy - water - transport - healthcare - finance - telco - education entities: [] techniques: - T1190 - T1505.003 - T1204.004 - T1059.001 - T1102.001 - T1555.003 - T1068 - T1027.011 affected_products: - WordPress Core - WordPress - PHP - Linux kernel cves: - id: CVE-2026-63030 cvss: null epss: null type: rce vector: zero-click auth: pre-auth status: - exploited - cisa-kev - patch-available affected: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 fixed: WordPress 6.9.5 / 7.0.2 - id: CVE-2026-60137 cvss: null epss: null type: sqli vector: zero-click auth: pre-auth status: - exploited - cisa-kev - patch-available affected: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 fixed: WordPress 6.9.5 / 7.0.2 - id: CVE-2026-31431 cvss: "7.8" epss: null type: priv-esc vector: local auth: post-auth status: - exploited - cisa-kev - poc-public - patch-available affected: Linux kernel from the 2017 in-place AEAD change fixed: mainline commit a664bf3d603d and distribution backports sources: - url: "https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core" publisher: Searchlight Cyber date: 2026-07-17 role: primary - url: "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/" publisher: WordPress.org date: 2026-07-17 role: primary - url: "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45280" publisher: ENISA EUVD date: 2026-07-17 role: corroborating - url: "https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html" publisher: The Hacker News date: 2026-07-17 role: corroborating - url: "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0250" publisher: NCSC-NL date: 2026-07-18 role: corroborating - url: "https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/" publisher: Rapid7 date: 2026-07-17 role: corroborating - url: "https://www.vulncheck.com/blog/wp2shell" publisher: VulnCheck date: 2026-07-17 role: corroborating - url: "https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/" publisher: Searchlight Cyber date: 2026-07-20 role: primary - url: "https://www.infosecurity-magazine.com/news/researchers-wordpress-exploit/" publisher: Infosecurity Magazine date: 2026-07-20 role: corroborating - url: "https://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/" publisher: SecurityWeek date: 2026-07-20 role: corroborating - url: "https://www.ncsc.admin.ch/ncsc/de/home/aktuell/im-fokus/2026/clickfix.html" publisher: NCSC Switzerland (BACS) date: 2026-08-07 role: primary - url: "https://blog.calif.io/p/the-wordpress-chain-massacre" publisher: Calif date: 2026-08-05 role: primary - url: "https://copy.fail/" publisher: Xint Code date: 2026-04-29 role: corroborating - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" publisher: CISA Known Exploited Vulnerabilities catalog date: 2026-08-07 role: corroborating - url: "https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/" publisher: Linux kernel CVE team date: 2026-04-22 role: corroborating closed_sources: [] evidence: - quote: The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins. publisher: Searchlight Cyber - quote: "It is not on CISA's KEV catalog, which takes confirmed exploitation, and none has been reported as of July 18." publisher: The Hacker News - quote: "Total usage: 50% of weekly usage. Pro-rata total cost on the $200 subscription: ~ $25 USD." publisher: Searchlight Cyber - quote: No security researcher could have found and completed this exploit chain in 10 hours without AI. publisher: Searchlight Cyber - quote: "Given confirmed exploitation in the wild, Rapid7 strongly recommends investigating for signs of compromise" publisher: Rapid7 - quote: "Hexastrike started seeing exploitation attempts in its honeypots over the weekend, and on Sunday the company said it had already assisted with incident response in several attacks." publisher: SecurityWeek - quote: We held off on publishing this issue to give defenders a chance to upgrade their WordPress instances over the weekend publisher: Searchlight Cyber - quote: "Do not attempt to use changelogs, git history, or the internet to 'diff' the code against a patched version." publisher: Searchlight Cyber - quote: Dabei verwenden Cyberkriminelle eine Kombination aus zwei Schwachstellen in WordPress publisher: NCSC Switzerland (BACS) - quote: "Unternehmen und Betreiberinnen kritischer Infrastrukturen, welche nicht im Fintech-Bereich tätig sind, sollten ausgehende Verbindungen zu RPC-Anbietern einschränken." publisher: NCSC Switzerland (BACS) - quote: "wp2shell drops you inside the PHP interpreter, and on a hardened host that interpreter is locked down. Dangerous functions like system() and exec() are switched off with disable_functions, the filesystem can be mounted read-only, and there may be nowhere to write a file." publisher: Calif - quote: "The first recovers the native system handler and calls it directly, in native code, even though disable_functions took away the PHP-level name." publisher: Calif - quote: "The su file on disk is never modified, so file-integrity monitoring that watches file contents or writes to the binary sees nothing." publisher: Calif - quote: The same 732-byte Python script roots every Linux distribution shipped since 2017. publisher: Xint Code verification: multi-source sourcing_note: > Multi-source: discoverer write-up, the WordPress.org release, both GitHub security advisories, NVD, EUVD, NCSC-NL, Rapid7 and VulnCheck all fetched. Two caveats carried explicitly: (1) CVSS is contested between assigners — the WPScan CNA scores CVE-2026-63030 at 9.8 and CVE-2026-60137 at 5.9, while NVD's CISA-ADP secondary assessment inverts the pair (7.5 and 9.1); the cves[] records carry the CNA scores. (2) A secondhand exploitation claim attributed to Patchstack circulated on 2026-07-17 evening, but Patchstack's own database page carries only a predictive 'expected to become exploited' statement, Rapid7 was 'not aware of publicly confirmed in-the-wild exploitation' as of 21:45Z 07-17, and The Hacker News reports none as of 07-18 — this entry therefore does NOT claim in-the-wild exploitation. confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 1 watchlist_hit: false actions: - "Patch every internet-reachable WordPress instance to 7.0.2 / 6.9.5 / 6.8.6 now — this is an out-of-band core security release for a pre-auth RCE chain that works on a stock install; where patching is delayed, apply NCSC-NL's interim mitigation of blocking /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF." - "Run a compromise assessment on every WordPress 6.9.0–6.9.4 / 7.0.0–7.0.1 instance that was internet-reachable at any point between the 2026-07-17 release and the moment you patched it — exploitation was live from 2026-07-19 and patching does not evict an attacker who already reached code execution: review web-server access logs for the batch endpoint, then audit administrator accounts, scheduled events and files written under the webroot since 2026-07-17." - "Restrict outbound connections from user endpoints to blockchain RPC-provider web interfaces, per BACS's own recommendation for companies and critical-infrastructure operators that are not in fintech — this is the takedown-resistant hop the pasted command depends on." - "Confirm every WordPress instance the organisation or its agencies publish is on 6.9.5 / 7.0.2 or later, and for any site that was reachable and unpatched, check for attacker-added administrator accounts and modified theme or plugin files rather than only applying the update." - "Check kernel patch state for CVE-2026-31431 on any host running PHP web applications — it is KEV-listed since 2026-05-01 and fixed upstream; where patching lags, blocking AF_ALG socket creation removes the root step without affecting dm-crypt, kTLS, IPsec or the default TLS libraries." updates: - at: "2026-07-21T04:44:00Z" run_id: 2026-07-21T0409Z-intel type: update summary: > Searchlight Cyber researcher Adam Kues tasked OpenAI's GPT5.6 to autonomously rediscover and weaponise the already-patched WordPress core pre-auth RCE chain "WP2Shell" (CVE-2026-63030 + CVE-2026-60137), reaching an unauthorised admin account on a stock install in roughly 10 hours for about $25 in model usage. The vulnerability and patch are unchanged from prior coverage; the new fact is the capability — autonomous chaining of a multi-stage pre-auth exploit at a cost and speed no human researcher matches, which compresses the safe window between an out-of-band patch shipping and being applied. fields: - affected_products - evidence - sectors - sources - tags - body merged_from: 2026-07-21/gpt56-autonomous-wordpress-wp2shell-exploit-chain - at: "2026-07-26T13:52:00Z" run_id: 2026-07-26T1308Z-audit type: update summary: > The WordPress Core "WP2Shell" pre-auth RCE chain (CVE-2026-63030 route confusion in the unauthenticated REST batch endpoint, chained with CVE-2026-60137 SQL injection) went from "no confirmed in-the-wild exploitation" at first coverage to confirmed exploitation: CISA added both CVEs to the Known Exploited Vulnerabilities catalog on 2026-07-21, and honeypot operators and incident responders reported live exploitation attempts and real intrusions from 2026-07-19. Any WordPress 6.9.0–6.9.4 or 7.0.0–7.0.1 instance that was internet-reachable before it was patched to 6.9.5 / 7.0.2 must now be treated as a compromise-assessment target. fields: - actions - cves - evidence - sources - tags - body merged_from: 2026-07-26/wp2shell-cve-2026-63030-60137-confirmed-exploited-kev - at: "2026-08-02T14:00:00Z" run_id: 2026-08-02T1309Z-audit type: correction summary: > This pipeline's 2026-07-21 entry has Searchlight Cyber's Adam Kues tasking GPT5.6 "to autonomously rediscover and weaponise the already-patched" WordPress WP2Shell chain, and the W30 weekly carried the same framing. The cited Searchlight Cyber post says the opposite: the model was pointed at the WordPress source and explicitly forbidden from diffing against a patched version or using changelogs and git history, and Searchlight then "held off on publishing this issue to give defenders a chance to upgrade their WordPress instances over the weekend". This pipeline's own 2026-07-18 entry already named Searchlight Cyber as the discoverer of CVE-2026-63030 and CVE-2026-60137. The correction matters because it changes the capability claim: not an LLM reconstructing a known, patched bug, but an LLM finding a pre-authentication RCE in WordPress core that no one had published, whose disclosure produced the out-of-band 7.0.2 / 6.9.5 / 6.8.6 release. fields: - evidence - tags - body merged_from: 2026-08-02/gpt56-wp2shell-was-an-original-zero-day-not-a-rediscovery - at: "2026-08-08T04:50:00Z" run_id: 2026-08-08T0409Z-intel type: update summary: > NCSC-CH (BACS) published an advisory on 2026-08-07 reporting a rising count of compromised Swiss websites serving fake CAPTCHAs that instruct visitors to paste and run a command, and names the WP2Shell WordPress chain (CVE-2026-63030 with CVE-2026-60137) as what Swiss site operators and hosting providers have been reporting as the entry point. The pasted command pulls its next stage from a public blockchain reached through RPC-provider web interfaces, typically ending in an infostealer such as Vidar. BACS asks companies and critical-infrastructure operators outside fintech to restrict outbound connections to RPC providers — a concrete egress-policy change, not awareness advice. fields: - actions - cves - evidence - regions - sectors - sources - tags - techniques - body merged_from: 2026-08-08/ncsc-ch-clickfix-wp2shell-etherhiding-vidar-swiss-websites - at: "2026-08-10T04:43:00Z" run_id: 2026-08-10T0411Z-intel type: update summary: > Calif published wp2root on 2026-08-05, a post-exploitation chain that starts where the WP2Shell pre-auth WordPress RCE ends — sandboxed PHP execution — and reaches fileless native root even where disable_functions blocks system() and the filesystem is read-only. A use-after-free in PHP's legacy Serializable path yields native code execution that calls PHP's own system handler directly, bypassing disable_functions because that setting removes only the PHP-level name. The root step is CVE-2026-31431 ("Copy Fail"), a Linux kernel flaw that overwrites the page-cache copy of a setuid-root binary without touching the file on disk — and which has been CISA KEV-listed for confirmed exploitation since 2026-05-01, independent of this research. fields: - actions - affected_products - cves - evidence - regions - sectors - sources - tags - techniques - body merged_from: 2026-08-10/wp2root-php-uaf-copy-fail-kev-kernel-lpe-to-native-root migrated_from: null --- WordPress shipped an out-of-band core security release on 2026-07-17 fixing a pre-authentication remote-code-execution chain that researcher Adam Kues of Searchlight Cyber calls **WP2Shell** ([WordPress.org, 2026-07-17](https://wordpress.org/news/2026/07/wordpress-7-0-2-release/); [Searchlight Cyber, 2026-07-17](https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core)). The chain's first half, CVE-2026-63030, is a route-confusion weakness (CWE-436) in the REST API batch endpoint — `/wp-json/batch/v1`, also reachable as `?rest_route=/batch/v1` — which processes several sub-requests in one call; a parsing quirk desynchronizes internal request arrays so one sub-request executes under another's handler. Chained with CVE-2026-60137 — an SQL injection in the `author__not_in` parameter of `WP_Query`, the class that builds most WordPress database queries — it yields code execution with no authentication, no plugins and no special configuration: "the attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins" ([Searchlight Cyber, 2026-07-17](https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core)). The full chain affects 6.9.0–6.9.4 and 7.0.0–7.0.1; the SQL-injection component reaches back into 6.8.x, where it is exposed when a plugin or theme passes untrusted input to the parameter ([ENISA EUVD, 2026-07-17](https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45279)). Scoring is contested between assigners: the WPScan CNA rates the RCE component 9.8 and the SQLi 5.9, while the CISA-ADP secondary assessment carried by NVD and EUVD inverts the pair at 7.5 and 9.1 ([ENISA EUVD, 2026-07-18](https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45280)). Searchlight Cyber withheld exploit mechanics "to give defenders time to patch" and instead published a checker tool; VulnCheck's independent analysis describes the practical post-exploitation route as dumping credential hashes via the SQL injection, cracking or reusing an administrator login, and dropping a webshell through the admin interface ([VulnCheck, 2026-07-17](https://www.vulncheck.com/blog/wp2shell)). Public proof-of-concept code is already on GitHub — The Hacker News reports "a working proof-of-concept has gone up on GitHub" ([The Hacker News, 2026-07-17](https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html)), while an earlier-observed public repository carried only detection-grade probing (time-based blind SQL-injection and route-confusion checks); either way, exploit tooling is public. Exploitation status as of publication: Rapid7 was "not aware of publicly confirmed in-the-wild exploitation" as of 2026-07-17 evening ([Rapid7, 2026-07-17](https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/)), the CVE pair is not in CISA KEV, and a circulated secondhand exploitation claim traces back to a Patchstack database page that in fact makes only the predictive statement "this vulnerability is highly dangerous and expected to become exploited." NCSC-NL's advisory rates likelihood high and expects short-term exploitation, recommending WAF-blocking of the batch endpoint where patching must wait ([NCSC-NL, 2026-07-18](https://advisories.ncsc.nl/advisory?id=NCSC-2026-0250)). **Defender takeaway:** WordPress runs a large share of Swiss and European municipal, cantonal and public-institution web presences, usually behind auto-update — but auto-update is exactly what fleet operators disable on managed estates, so verify the fix level rather than assume it. Detection while unpatched hosts remain: in web/access-log telemetry, POST requests to `/wp-json/batch/v1` (or `rest_route=/batch/v1` query strings) from unauthenticated clients are the chain's entry point — the batch endpoint is legitimately used by the block editor and some plugins, so the discriminators are batch calls without an authenticated session cookie or nonce, response-time patterns consistent with time-based blind SQL injection, and batch sub-requests referencing author-query parameters; any subsequent first-time admin login or plugin/theme-editor file write from the same client chain is the escalation signal. ## Update — 2026-07-21T04:44:00Z Searchlight Cyber's Adam Kues tasked OpenAI's GPT5.6 model — running autonomously for up to 10 hours per session — to independently rediscover and weaponise "WP2Shell", the WordPress core pre-authentication RCE chain this pipeline covered on 2026-07-18 (CVE-2026-63030, a REST batch-endpoint route-confusion flaw, chained with CVE-2026-60137, an SQL injection in `WP_Query`'s `author__not_in` parameter; both patched out of band in WordPress 7.0.2/6.9.5/6.8.6 on 2026-07-17). Without human guidance beyond the initial task, the model recursively chained batch API requests to bypass method validation, poisoned the request cache with fabricated posts, abused the oEmbed subsystem to insert database rows, and replayed a request with elevated administrator context via the `parse_request` hook — ending with an unauthorised admin account on a stock, plugin-free install ([Searchlight Cyber, 2026-07-20](https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/)). Kues put the cost at roughly $25 — "50% of weekly usage ... ~ $25 USD" on a $200 subscription — and states plainly that "no security researcher could have found and completed this exploit chain in 10 hours without AI." Infosecurity Magazine corroborates ([Infosecurity Magazine, 2026-07-20](https://www.infosecurity-magazine.com/news/researchers-wordpress-exploit/)). Nothing about the CVEs, affected versions or patch guidance has changed — this is a capability finding, not a new vulnerability. **Defender takeaway:** the delta is the exploitation timeline. When a disclosed-and-patched pre-auth RCE can be independently reconstructed into a working chain in hours for pocket change, "patched but not yet applied" is a shorter safe state than teams have historically assumed. For WordPress-core estates the practical consequence is to treat out-of-band core security releases (like 7.0.2) as time-critical rather than routine, and to prioritise internet-facing installs; the patch action itself is the one carried in the 2026-07-18 entry. ## Update — 2026-07-26T13:52:00Z The exploitation status of the WP2Shell chain has flipped. First coverage recorded a public checker, public proof-of-concept code and an NCSC-NL assessment that exploitation was expected shortly, but no confirmed in-the-wild activity. That is no longer the case: "both CVEs were added to CISA's Known Exploited Vulnerabilities (KEV) catalog on July 21" ([Rapid7, 2026-07-22](https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/)). Rapid7 updated its analysis the same day to state that "Given confirmed exploitation in the wild, Rapid7 strongly recommends investigating for signs of compromise" ([Rapid7, 2026-07-22](https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/)). Exploitation was observable earlier than the KEV date: Hexastrike "started seeing exploitation attempts in its honeypots over the weekend, and on Sunday the company said it had already assisted with incident response in several attacks", and watchTowr independently reported in-the-wild attempts ([SecurityWeek, 2026-07-20](https://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/)). Nothing about the vulnerable component, the prerequisites or the patched versions has changed — the affected branches remain 6.9.0–6.9.4 and 7.0.0–7.0.1, fixed in 6.9.5 and 7.0.2 respectively ([Rapid7, 2026-07-22](https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/)). What changes is the defender's posture. A chain that reaches pre-authentication code execution on a stock installation, against a platform this widely deployed across public-sector web estates, and that was being exploited within roughly 48 hours of the out-of-band release, leaves a real window in which an internet-reachable instance could have been taken over before its administrator patched. Patching closes the entry route; it does not remove a webshell, an attacker-created administrator account, or a scheduled task planted beforehand. **Defender takeaway:** treat the patch as the start of the response rather than the end of it. The interval that matters runs from the 2026-07-17 release to the moment each instance was actually updated — inventory which sites were internet-reachable during that interval and assess those first. **Triage:** requests to the REST batch endpoint are a legitimate WordPress feature, so their presence alone is not the signal; what distinguishes exploitation from normal use is unauthenticated batch requests arriving from unfamiliar source ranges in tight bursts, immediately followed by a PHP file appearing under the webroot, a new administrator-role user, or an outbound connection from the web-server process. In web-server access telemetry, correlate on the sequence rather than the endpoint. Post-compromise, the higher-signal artefacts are administrator accounts created after 2026-07-17, unexpected entries in the scheduled-event table, and PHP files whose modification time postdates the release but which are not part of the shipped core distribution. ## Correction — 2026-08-02T14:00:00Z The original entry's framing was wrong in the direction that understates the finding, and the weekly strategic entry for W30 inherited it. The correction was found by this pipeline's own weekly quality audit re-reading the cited primary. What Searchlight Cyber's Adam Kues actually ran was a discovery test, not a reconstruction test. The prompt handed to GPT5.6 Sol Ultra opens "This is a test of your ability to discover zero-days" and then closes off the shortcut explicitly: "Do not attempt to use changelogs, git history, or the internet to 'diff' the code against a patched version." Kues explains the reasoning in his own voice — for novel vulnerability discovery, letting a model look at change history is a waste of tokens — and adds a second guard against a failure mode he names directly: models sometimes cheat to achieve what you ask, "either by choosing extremely unlikely configuration options or by fabricating preconditions that aren’t achievable by an attacker" ([Searchlight Cyber, 2026-07-20](https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/)). The model was told a pre-auth-to-RCE chain existed in the repository and asked to find it from first principles, which is a directed hunt with a known-positive — but it is a hunt for something not yet public, not a rebuild of something already published. The disclosure timeline settles it. Searchlight "held off on publishing this issue to give defenders a chance to upgrade their WordPress instances over the weekend", and during that hold two other parties independently reproduced the full chain before proof-of-concept code surfaced on GitHub. A researcher does not delay publication of a rediscovery of an already-patched bug to protect defenders; the delay only makes sense because the disclosure came first and the patch was the response to it. This pipeline's 2026-07-18 entry on the WP2Shell chain reached the same conclusion from the other direction, recording Searchlight Cyber as the **discoverer** of CVE-2026-63030 and CVE-2026-60137 and noting the out-of-band WordPress release of 2026-07-17 — so the store already carried the correct attribution one entry earlier and then contradicted itself three days later. **Defender takeaway:** the corrected reading raises rather than lowers where this sits on the capability curve, and it is the curve that drives planning assumptions. "An LLM can rebuild a known patched exploit in ten hours for $25" says exploitation of disclosed bugs is getting cheaper, which mainly compresses patch windows. "An LLM found a previously unpublished pre-authentication RCE chain in the source of the most widely deployed CMS on the internet, at that cost, under a prohibition on looking at the fix" says something different: that novel vulnerability discovery against large, mature, heavily audited codebases is now within reach of a small budget. For a defender the practical consequence is not a control to deploy but an assumption to revise — the arrival rate of pre-auth flaws in widely deployed software is more likely to rise than to stay flat, which argues for shortening the gap between an out-of-band release and its deployment rather than for anything new in the stack. **Triage:** nothing here is an alertable behaviour — this is a correction to a capability assessment. The WP2Shell chain itself remains covered by this pipeline's 2026-07-18 disclosure entry and its 2026-07-26 confirmed-exploitation and KEV update, which carry the exploitation detail, the affected version boundaries and the compromise-assessment guidance; that guidance is unchanged by this correction. ## Update — 2026-08-08T04:50:00Z Switzerland's national cyber authority has attached its own jurisdiction's numbers to the WordPress chain this pipeline recorded reaching CISA KEV in July. In an advisory published 2026-08-07, BACS reports a rising count of compromised websites presenting fake CAPTCHAs that push visitors into executing a command themselves, puts the worldwide population of compromised sites at more than 100,000, and states it is currently seeing an increase in the number of Swiss websites being compromised and used to distribute malware ([NCSC-CH, 2026-08-07](https://www.ncsc.admin.ch/ncsc/de/home/aktuell/im-fokus/2026/clickfix.html)). The entry point is the already-covered one, now with reporting behind it: BACS writes that in recent days it has received an accumulation of reports from Swiss website operators and web-hosting providers describing exploitation of two recently disclosed WordPress vulnerabilities, and that "criminals use a combination of two vulnerabilities in WordPress" known as WP2Shell — CVE-2026-63030 and CVE-2026-60137 ([NCSC-CH, 2026-08-07](https://www.ncsc.admin.ch/ncsc/de/home/aktuell/im-fokus/2026/clickfix.html)). Most of the compromised sites run WordPress. What is new below the entry point is the delivery chain. Once a visitor follows the instruction and runs the command, it fetches further malicious code whose storage and distribution sit on a public blockchain — the technique BACS names EtherHiding — retrieved through the web interfaces of RPC providers that broker access to those networks; the payload is typically an infostealer, with Vidar named as an example, going after credentials, payment-card data and cryptocurrency wallets ([NCSC-CH, 2026-08-07](https://www.ncsc.admin.ch/ncsc/de/home/aktuell/im-fokus/2026/clickfix.html)). That hop is why the authority's recommendation is an egress-policy one rather than a filtering one: a blockchain read has no domain to sinkhole. **Defender takeaway:** BACS's guidance for organisations rather than for the public is specific and unusually easy to action — companies and operators of critical infrastructure that are not active in the fintech sector should restrict outgoing connections to RPC providers ([NCSC-CH, 2026-08-07](https://www.ncsc.admin.ch/ncsc/de/home/aktuell/im-fokus/2026/clickfix.html)). For a Swiss public-sector estate this cuts both ways: it is an outbound control on your own users, and a patch-state question about every WordPress site your organisation or its agencies publish, because those sites are what is being turned into the delivery surface for everyone else. **Triage:** the client-side execution has a distinctive shape in process-creation telemetry with parent lineage — a command interpreter (`powershell.exe` on Windows, the terminal shell on macOS) started from a browser process tree, immediately followed by outbound HTTP to an RPC-provider endpoint. Neither half is individually rare on a developer or administrator workstation; the sequence, on a general-office endpoint, is the signal, and the browser parentage is what separates it from legitimate admin scripting, which is not launched from a browser. On the server side, the compromise signature is the WP2Shell request pattern against the unauthenticated REST batch endpoint in web-server access logs, followed by administrator-account or plugin and theme file changes that no admin action accounts for. ## Update — 2026-08-10T04:43:00Z The WP2Shell WordPress chain that NCSC-CH named as the entry point for compromised Swiss websites serving fake-CAPTCHA lures now has a published, fully documented route from where it stops to native root. Calif's wp2root write-up of 2026-08-05 is the delta ([Calif, 2026-08-05](https://blog.calif.io/p/the-wordpress-chain-massacre)); the original entry stands unchanged. The premise is the hardened-host case defenders actually rely on. As the researcher puts it, "wp2shell drops you inside the PHP interpreter, and on a hardened host that interpreter is locked down. Dangerous functions like system() and exec() are switched off with disable_functions, the filesystem can be mounted read-only, and there may be nowhere to write a file." wp2root's contribution is that none of those three controls holds. Escaping PHP uses a use-after-free on the legacy `Serializable` interface path, where recursive `unserialize()` calls inside a `Serializable::unserialize()` body share the outer parser's reference table and a later property-table resize frees a bucket the outer parser still holds. The resulting arbitrary read builds a chain that locates the PHP binary and its gadgets in the live process rather than relying on hardcoded offsets, and then — this is the part that matters for anyone treating `disable_functions` as a boundary — "recovers the native system handler and calls it directly, in native code, even though disable_functions took away the PHP-level name." The setting removes a name, not the underlying handler. The alternative path launches a position-independent stager that creates an anonymous in-memory file, pins it on a file descriptor that survives `execve`, and executes it without anything reaching disk. The root step is where this stops being a research curiosity. It is CVE-2026-31431, "Copy Fail" — a logic flaw reachable through the kernel's AF_ALG crypto socket interface and `splice()` that lets an unprivileged local user overwrite the page-cache copy of a setuid-root binary with a small write. Running that binary then executes the attacker's cached stub as root. Its discloser is explicit about the defensive consequence: "The su file on disk is never modified, so file-integrity monitoring that watches file contents or writes to the binary sees nothing." The same page records that "The same 732-byte Python script roots every Linux distribution shipped since 2017" ([Xint Code, 2026-04-29](https://copy.fail/)). The fact that changes the risk calculation, and that neither the original coverage nor the queue note carried: CVE-2026-31431 has been on CISA's Known Exploited Vulnerabilities catalogue since 2026-05-01, listed as a Linux Kernel incorrect-resource-transfer flaw allowing privilege escalation, entirely independent of this chain-building exercise ([CISA, catalog version 2026.08.07](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)); the kernel's own CVE announcement records the flaw ([Linux kernel CVE team, 2026-04-22](https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/)). The kernel half of wp2root is not a proof of concept — it is a bug attackers are already using, now documented as the root step for a WordPress compromise path with confirmed exploitation against this constituency's own web estate. Detection, telemetry class first. On the PHP side the discriminating signal is a web-server worker process spawning a child whose executable resolves to an anonymous memory-backed file rather than a normal on-disk binary — legitimate PHP application workflows do not create processes that way, which makes it low-noise. For the kernel step, any process holding an AF_ALG socket is itself unusual: the mainstream consumers of kernel crypto, including disk encryption, kernel TLS and IPsec, use the in-kernel API and never touch AF_ALG. **Triage:** a setuid-root binary executing is ordinary on every Linux host, so that event alone is noise; the composite that is not ordinary is an AF_ALG socket opened and closed by a web-application process, followed shortly by a setuid binary running under that same process tree. **Defender takeaway:** the durable lesson is that `disable_functions` and a read-only filesystem are defence in depth, not a boundary — this chain walks through both — so a WordPress pre-auth RCE should be scoped as potential host root, not as contained web-tier execution. Patching the kernel closes the published root step; the PHP-side escape remains reachable from any pre-existing code-execution foothold.