A sophisticated campaign known as "wp2shell" is actively targeting a universal weakness in WordPress itself, not a plugin, to install persistent backdoors on compromised sites. This widespread threat exploits two critical flaws in the WordPress core, allowing attackers with minimal initial access to seize control and establish a foothold that survives restarts and updates.
The vulnerabilities, designated CVE-2026-63030 and CVE-2026-60137, are particularly severe because they reside in the foundational software powering millions of websites. This core exposure means any WordPress installation, regardless of its theme or plugin configuration, is a potential target. The attack unfolds in two stages: first, an adversary uses the flaw to escalate privileges from a low-privileged subscriber account, then they deploy persistent webshells and malicious plugins designed to grant ongoing remote command execution.
A key danger of the "wp2shell" campaign is the resilience of the installed backdoors. Security researchers warn that these tools persist across system reboots. Critically, simply applying a WordPress update after an infection is not sufficient to clean a compromised site. Administrators must undertake active, manual remediation, scanning both their file systems and databases to identify and remove the unauthorized code.
In response, the WordPress project has released emergency patches across all supported major versions. Site administrators are directed to update immediately to the latest version within their branch:
- WordPress 6.6.2
- WordPress 6.5.4
- WordPress 6.4.6
- WordPress 6.3.6
- WordPress 6.2.9
- WordPress 6.1.9
- WordPress 6.0.11
- WordPress 5.9.11
However, patching is only the definitive first step. The security advisory mandates a follow-up audit. Administrators must conduct a thorough scan for indicators of a prior breach, searching for suspicious plugins, unfamiliar files, or code injections that indicate the persistent webshells are already in place.
This incident also demands a review of user access controls. Since the exploit chain begins with standard subscriber-level permissions, organizations should audit all user accounts and enforce the principle of least privilege. To bolster defenses, deploying a Web Application Firewall (WAF) and ensuring reliable, verified backups are now considered essential measures for resilience.
With the vulnerabilities under active exploitation, the window to secure sites is rapidly closing. This campaign underscores that for core infrastructure like WordPress, a rapid patching cadence is not optional—it is a critical operational priority.
一個名為「wp2shell」的複雜攻擊行動，正利用 WordPress 系統本身（而非外掛程式）的普遍弱點，在被入侵的網站上安裝持續性後門。這項廣泛威脅利用了 WordPress 核心中的兩個關鍵漏洞，讓攻擊者在獲得最低限度的初始訪問權後，便能奪取控制權並建立一個在系統重啟和更新後仍能存活的據點。
被編為 CVE-2026-63030 和 CVE-2026-60137 的漏洞尤為嚴重，因為它們存在於支撐數百萬個網站的基礎軟件中。這種核心暴露意味著，無論其佈景主題或外掛程式配置如何，任何 WordPress 安裝都可能是潛在目標。攻擊分兩階段進行：首先，攻擊者利用漏洞將權限從一個低權限的訂閱者帳戶提升，然後他們部署持久性的網絡後門和惡意外掛程式，旨在授予持續的遠端命令執行能力。
「wp2shell」攻擊行動的一個關鍵危險在於已安裝後門的頑固性。安全研究人員警告，這些工具在系統重啟後依然存在。關鍵的是，感染後僅套用 WordPress 更新並不足以清理受感染的網站。管理員必須採取主動、手動的補救措施，掃描其檔案系統和資料庫以識別並移除未經授權的程式碼。
作為回應，WordPress 專案已針對所有支援的主要版本發布了緊急修補程式。網站管理員被指引立即更新至其分支的最新版本：
- WordPress 6.6.2
- WordPress 6.5.4
- WordPress 6.4.6
- WordPress 6.3.6
- WordPress 6.2.9
- WordPress 6.1.9
- WordPress 6.0.11
- WordPress 5.9.11
然而，應用補丁只是決定性的第一步。安全公告要求進行後續審計。管理員必須全面掃描先前入侵的跡象，搜尋可疑的外掛程式、陌生檔案或程式碼注入，這些都表明持久性網絡後門可能已就位。
此事件亦要求審查用戶訪問控制。由於漏洞利用鏈始於標準的訂閱者級別權限，組織應審計所有用戶帳戶並執行最低權限原則。為了加強防禦，部署網絡應用程式防火牆（WAF）和確保有可靠、經驗證的備份，現已被視為維持韌性的必要措施。
由於漏洞正遭活躍利用，保護網站的窗口正在迅速關閉。這次攻擊行動強調，對於像 WordPress 這樣的核心基礎設施而言，快速的修補節奏並非可選——這是一項關鍵的營運優先事項。