THREATOPS
THREAT OPS › Threat News › WP2Shell WordPress Exploit Technical Analysis and Real Attack Data

WP2Shell WordPress Exploit Technical Analysis and Real Attack Data

medwordfencePublished 2026-07-29

<p>On July 17th, 2026, the WordPress Security Team released updates to WordPress core addressing a critical vulnerability chain that can be leveraged by unauthenticated attackers to create an administrator account and then execute code through normal administrator capabilities, such as uploading a plugin.</p> <p>The chain consists of two vulnerabilities: an unauthenticated SQL injection vulnerabil

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://www.wordfence.com/blog/2026/07/wp2shell-wordpress-exploit-technical-analysis-and-real-attack-data/