WordPress Wp2shell Exploitation Tool User-Agent

Status: experimental
Severity: high
Log source: category webserver
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the hardcoded "wp2shell" User-Agent string used by the wp2shell PoC tool during all phases of CVE-2026-63030 and CVE-2026-60137 exploitation.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Rule body

title: WordPress Wp2shell Exploitation Tool User-Agent
id: a7c4e2f9-1b38-4d5c-9e72-3f4a5b6c7d8e
status: experimental
description: |
    Detects the hardcoded "wp2shell" User-Agent string used by the wp2shell
    PoC tool during all phases of CVE-2026-63030 and CVE-2026-60137 exploitation.
references:
    - https://github.com/Icex0/wp2shell-poc
    - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
    - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-07-19
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026-63030
    - cve.2026-60137
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        cs-user-agent: 'wp2shell'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    cs-user-agent: 'wp2shell'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`cs-user-agent`	eq	`wp2shell`	`field:"cs-user-agent" kind:eq value:"wp2shell"`