WordPress wp2shell Exploit Analysis: Vulnerability Vector

Security researchers have published a detailed technical analysis of the 'wp2shell' exploit vector, shedding light on how automated botnets are actively scanning and compromising unpatched WordPress servers. The exploit leverages a logic flaw in the REST API's serialization handler to register unauthorized callback functions in the database.

Once the callback is registered, the attacker triggers its execution by sending a crafted HTTP request to a public API endpoint. This bypasses all authentication controls, allowing the attacker to write a persistent web shell to the server's upload directory and gain complete administrative control over the host operating system.

Deconstructing the wp2shell REST API Exploit Pathway

Administrators are advised to inspect their web server access logs for unusual POST requests targeting the `/wp-json/wp/v2/` API namespaces. Key indicators of compromise include the presence of unrecognized PHP files in the `wp-content/uploads/` directory and unauthorized administrative users in the database tables.

Indicators of Compromise and Defensive Recommendations

To mitigate the risk of compromise, developers should implement rate limiting on API endpoints, block direct execution of PHP files in upload folders, and update to WordPress Core immediately. Auditing database integrity remains an essential post-incident recovery step to identify backdoor accounts left behind.