Hackers are actively targeting WordPress websites by exploiting a recently disclosed vulnerability known as WP2Shell, according to cybersecurity researchers. The flaw allows attackers to gain remote access to vulnerable websites without needing a username or password, making it one of the most serious WordPress security issues in recent years.
Security researchers have observed attackers scanning websites through WordPress's REST API batch endpoint (/?rest_route=/batch/v1) and launching attacks against unpatched installations. Reports indicate that attackers first send a request to check whether a website is vulnerable. If successful, they follow up with a second request that exploits the flaw, installs a web shell, and can ultimately lead to complete website takeover.
Last week, WordPress released security updates to fix two critical vulnerabilities that together form the WP2Shell exploit chain. Due to the severity of the issue, WordPress enabled automatic updates for many affected websites and urged site owners to update immediately.
The vulnerability affects WordPress versions 6.8.0 through 6.8.5, 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1. Websites running these versions may be at risk if they have not yet been updated.
One of the most talked-about aspects of the discovery is the reported involvement of artificial intelligence. Security researcher Adam Kues of Searchlight Cyber stated that OpenAI's GPT-5.6 Sol helped identify and connect multiple WordPress vulnerabilities that ultimately formed the WP2Shell exploit chain. According to Kues, the exploit was developed in just over 10 hours during a security research experiment.
How the WP2Shell Attack Works
The WP2Shell exploit combines multiple security flaws in WordPress. Attackers begin by sending a specially crafted HTTP request to the vulnerable REST API endpoint. The vulnerability then allows malicious database queries to bypass security checks through SQL injection techniques. Once successful, attackers can install a web shell, giving them remote access to the website and allowing them to execute commands, upload files, create administrator accounts, and maintain long-term control of the server.
WP2Shell Attack Flow
Attacker sends a malicious HTTP request.
The request targets the vulnerable REST API batch endpoint.
Security checks are bypassed through SQL injection.
A hidden web shell is installed on the server.
The attacker gains remote access.
Administrator accounts, malware, or backdoors can be added.
Why This Vulnerability Is Serious
The WP2Shell vulnerability is considered critical because it allows attackers to gain access to a website without needing valid login credentials. Once a website is compromised, hackers can install malware, create hidden administrator accounts, steal sensitive information, and maintain long-term access to the server.
Website Takeover
One of the biggest risks is complete website takeover. Attackers can gain administrative control, modify website content, upload malicious files, and change website settings without the owner's knowledge.
Malware Infections
Hackers can use compromised websites to distribute malware, redirect visitors to malicious websites, or infect users with harmful software. This can damage both the website and its visitors.
SEO Spam
Cybercriminals often use hacked websites to create spam pages, inject suspicious links, or publish fake content. This can harm search engine rankings, reduce organic traffic, and damage a company's online reputation.
Data Theft
If attackers gain access to the website's database, they may be able to steal customer information, contact details, login credentials, and other sensitive business data.
Why This Matters for Businesses
Many businesses rely on their websites to generate leads, sell products, manage bookings, and communicate with customers. A successful WP2Shell attack could lead to website downtime, loss of customer trust, financial losses, and potential data breaches.
For organisations that depend on their online presence, website security is not just an IT concern—it is a business priority. Regular updates and security monitoring can help reduce the risk of costly cyberattacks.
How to Protect Your Website
Update WordPress Immediately
Website owners should update WordPress to the latest patched version as soon as possible. Security updates have already been released to address the vulnerabilities associated with WP2Shell.
Review Administrator Accounts
Check all administrator accounts and remove any unfamiliar users that may have been added without authorisation.
Inspect Website Files
Review important directories, especially cache folders, for suspicious PHP files or recently modified files that you do not recognise.
Monitor Security Activity
Keep an eye on server logs, security alerts, and unusual website behaviour. Early detection can help prevent further damage.
Use Security Tools
Consider implementing a Web Application Firewall (WAF), malware scanning tools, regular website backups, and security monitoring solutions. These measures can help detect and block threats before they cause significant damage.
Conclusion
The WP2Shell vulnerability highlights how quickly cybersecurity threats can evolve and how important it is to keep websites updated and secure. With attackers already scanning for vulnerable WordPress installations and reports suggesting AI-assisted vulnerability discovery played a role in creating the exploit chain, website owners should take immediate action.
Whether you are a developer, business owner, student, or website administrator, staying informed and following security best practices remains one of the most effective ways to protect your website and its users.
