wp2shell mass scanning confirmed — patch triage tonight

Two days ago the first-signs update closed with “widespread/mass exploitation — unconfirmed.” As of today’s Hacker News writeup, that clause is done. KEVIntel, watchTowr, Wiz, and Cloudflare are all citing telemetry of broad Internet scanning against CVE-2026-63030 — the wp2shell unauthenticated RCE — with observed post-exploitation ranging from webshell drops to persistent backdoor admin accounts. If you run a public-facing WordPress site on 6.9.0–6.9.4 or 7.0.0–7.0.1 that has not been updated since July 17, treat it as compromise-adjacent and move.

What changed

• KEVIntel’s Ryan Dewhurst, via The Hacker News, says exploitation “has expanded from targeting WordPress-specific sensors to broad Internet scanning, with the requests matching publicly available proof-of-concept (PoC) exploits.” Their telemetry counted 13 unique source IPs across Switzerland, Germany, the U.K., Indonesia, Lithuania, the Netherlands, and Singapore.
• watchTowr’s Jake Knott told the same outlet the firm registered “tens of thousands of exploitation attempts” across its honeypot infrastructure. Two days ago that was “first signs.” Now it’s spray scale.
• Wiz reports 60% of WordPress organizations had at least one vulnerable instance at publication; 25% had a public-Internet-exposed one. Wiz characterizes the current wave as “high-volume scanning activity without subsequent post-exploitation, suggesting opportunistic mass-scanning campaigns” — plural actors, not one crew.
• Post-exploit patterns are no longer theoretical. The Hacker News write-up, drawing from the same vendor reports, documents:
  • A ~150KB webshell dropped as a fake WordPress security plugin under the name CMSmap, functioning as a full attack platform (file management, database access, port scanning, MySQL UDF privilege escalation).
  • 100+ backdoor administrator accounts created for persistence.
  • Repeated installation of Overlord, a Go-based remote access trojan.
  • LFI probes for database credentials and auth keys; user enumeration for admin usernames and emails.

Confidence

• Mass scanning against CVE-2026-63030 — confirmed, four named vendors reporting independently.
• Post-exploitation activity (CMSmap webshell, backdoor admin accounts, Overlord RAT) — as-reported via The Hacker News’s aggregation of KEVIntel, watchTowr, and Wiz telemetry. Confirmed enough to plan around; not attributed to a named actor.
• Attribution or campaign clustering — none. Wiz’s “opportunistic” language is the strongest anyone will commit to right now.
• CISA KEV entry for CVE-2026-63030 — not present at time of filing. Expect one shortly; when it lands, BOD 26-04 compresses the federal-civilian patch window to days.

What to actually do

The order matters. Do them in this order.

1. Patch 6.9.x and 7.0.x public-facing instances to 6.9.5 or 7.0.2 tonight. This is the compromise-scale action item. If your change-management process says “next window,” override it — every hour of delay on an unpatched public instance costs more than any procedural cover you’ll get from waiting. The wordpress.org 7.0.2 release announcement has the current patched-branch matrix.
2. If you can’t patch immediately, take the instance off the public Internet. WAF virtual patches from managed WordPress hosts exist; you don’t run one. Cutting Internet exposure is the reliable control here.
3. Assume compromise on any 6.9.x/7.0.x instance that has been public and unpatched since July 17. Enumerate wp_users, especially administrator role. Any admin accounts created since July 17 that you don’t recognize — delete them, rotate every remaining admin credential, revoke and reissue application passwords.
4. Sweep for the CMSmap-shaped webshell. ~150KB PHP dropped into a plugin directory under the guise of a “security” plugin is the shape to look for. Check wp-content/plugins/ subdirectories that don’t match your inventory, and diff against the official distribution on wordpress.org.
5. Patch 6.8.x to 6.8.6 for CVE-2026-60137 if any plugin or theme could pipe user input into WP_Query’s author__not_in. Not the compromise-scale primitive but it’s cheap to close.

Honest priority

The RCE is what you’re patching this weekend, not the SQLi. Do not let a scoping argument about which plugins touch author__not_in slow down the 6.9.x/7.0.x update. Patch the RCE first. If you have a change window blocking the update, you have a bigger problem than the CVE — resolve that, then patch.

Related coverage on this site

• wp2shell first-signs exploitation (July 20) — airgap.
• wp2shell RCE PoC public (July 18) — airgap.
• CVE stubs: CVE-2026-63030 and CVE-2026-60137.

Sources

• The Hacker News: WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning — July 21, 2026.
• NVD: CVE-2026-63030 and CVE-2026-60137.
• WordPress: 7.0.2 release announcement.