wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution
We ran the wp2shell WordPress RCE chain end-to-end with Elastic Defend. Detection rule walkthrough, IOCs, and hunt guidance.
- Vendor
- Elastic
- Product
- WordPress core, Elasticsearch / Kibana
- Exposure class
- Web platform, Database
Why it ranks 21 (Routine)
- Product class: web platform, database
- Covered by 5 independent sources
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Elastic Security Labs (elastic.co)
- CVE-2026-63030 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-60137 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.