WordPress Wp2shell Webshell Plugin Access

Status: experimental
Severity: critical
Log source: category webserver
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects post-exploitation access to the wp2shell webshell plugin dropped after successful exploitation of CVE-2026-63030 and CVE-2026-60137. After the pre-auth SQLi-to-admin bridge is established, the attacker can upload a malicious plugin (wp2shell) to the target WordPress instance. At this phase, the attacker accesses the webshell for command execution and persistence.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1505.003` Server Software Component: Web Shell

Rule body

title: WordPress Wp2shell Webshell Plugin Access
id: c9e6f412-3d50-4f7e-bf94-5b6c7d8e9f0a
status: experimental
description: |
    Detects post-exploitation access to the wp2shell webshell plugin dropped after successful
    exploitation of CVE-2026-63030 and CVE-2026-60137. After the pre-auth SQLi-to-admin bridge is established,
    the attacker can upload a malicious plugin (wp2shell) to the target WordPress instance.
    At this phase, the attacker accesses the webshell for command execution and persistence.
references:
    - https://github.com/Icex0/wp2shell-poc
    - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
    - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-07-19
tags:
    - attack.execution
    - attack.persistence
    - attack.t1505.003
    - cve.2026-63030
    - cve.2026-60137
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        cs-uri-stem|contains: '/wp-content/plugins/wp2shell_'
    filter_optional_null_query:
        cs-uri-query: null
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - Unlikely
level: critical

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_optional_*

Stage 1: `selection`

selection:
    cs-uri-stem|contains: '/wp-content/plugins/wp2shell_'

Stage 2: `not filter_optional_null_query`

filter_optional_null_query:
    cs-uri-query: null

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`cs-uri-query`	is_null	(no value, null check)	`excludes:cs-uri-query`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`cs-uri-stem`	match	`/wp-content/plugins/wp2shell_`	`field:"cs-uri-stem" kind:match value:"/wp-content/plugins/wp2shell_"`