Last week, security researchers disclosed a remote code execution flaw in WordPress, the well-known content management system. Dubbed wp2shell, the vulnerability combines REST API batch-route confusion with a SQL input weakness. When an attacker successfully chains these flaws together, remote code execution becomes possible. The researchers withheld the technical particulars, yet attackers leaned on AI to reverse-engineer the underlying mechanism with alarming speed.
Attacks Began Within Hours of Disclosure
Because the flaw carries such severe risk, the researchers first reported it privately to the vendor. WordPress quickly shipped a new release and pushed automatic upgrades to affected versions through its update system. Sites that forcibly disable the update mechanism, however, may never receive the fix. At the very least, every site should be configured to accept security updates the option labeled “maintenance and security releases” in the admin panel.
Attackers, though, are also harnessing AI to hunt for bugs. Their task is deceptively simple. Since WordPress is open source, they merely compare the code changes between the old and new versions to deduce how the flaw can be exploited. Consequently, within hours of disclosure, security firms observed hackers already launching successful attacks.
According to security firm watchTowr, attackers initially abused the public flaw to steal hashed credentials, then moved on to executing remote code. Meanwhile, honeypots deployed by other vendors absorbed tens of thousands of attack attempts in a short span. Clearly, a large number of hackers are exploiting the flaw. Each one simply deploys a script, mass-scans WordPress sites across the internet, and attempts the exploit at scale. For the full account, see this research on finding a WordPress RCE with an AI model.
You Must Upgrade to a New or Maintenance Release
Sites protected by Cloudflare gain some relief. Cloudflare has deployed cloud-side rules to block exploitation of the flaw. Still, that is only a mitigation rather than a true fix. Therefore, if your site runs WordPress, you must immediately upgrade to the latest version or a maintenance release to seal the hole completely.
For sites not yet updated, administrators should stay vigilant. First, check for unfamiliar new admin accounts. Next, look for plugins you never installed. Finally, inspect the server for other suspicious files. If a site has already been breached, upgrading afterward comes too late. At that point, you can only make amends removing the attacker’s admin account and deleting any malicious files they planted.
Affected and Unaffected Versions
- WordPress 6.9.0 to 6.9.4 affected
- WordPress 7.0.0 to 7.0.1 affected
- WordPress 6.8.5 and earlier not affected
- WordPress 6.9.5 backported patch available
- WordPress 6.8.6 backported patch available
- WordPress 7.1 Beta 2 and later fixed
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
