On 17-Jul-2026 an obscure security outfit Searchlight Cyber published their discovery: wp2shell - remote code execution in recent WordPress versions. Of course it was on Friday, the best time to publish information about an extremely dangerous bug! 😡
Since my blog runs on WordPress, I decided to analyze my webserver logs and see what's happening in the wild.
How bad is this vulnerability?
Really bad. If your blog was vulnerable, you're most likely already hacked..
There were just few requirements:
- WordPress versions: 6.9.0 - 6.9.4, 7.0.0 - 7.0.1. This means most versions released between December 2025 and July 17, 2026 are vulnerable.
- WordPress automatic updates are disabled (NOT a default setting). WordPress automatic updates have been implemented for a while, but... Plenty of web developers and hosters switch automatic updates off and only deploy them after testing compatibility with their themes, plugins and tooling. Your luck may vary.
- WordPress REST API is enabled (default setting)
- Valid WordPress username/password is not required, which makes this bug extremely dangerous
Real life stats
The first scan for the vulnerability happened on 2026-07-18 12:32 UTC.
87.58.197.* - - [18/Jul/2026:14:32:34 +0200] "GET /wp-json/ HTTP/1.1" 401 129 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" 87.58.197.* - - [18/Jul/2026:14:32:34 +0200] "GET /?rest_route=/ HTTP/1.1" 401 129 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" 87.58.197.* - - [18/Jul/2026:14:32:35 +0200] "GET / HTTP/1.1" 200 46802 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" 87.58.197.* - - [18/Jul/2026:14:32:35 +0200] "POST /wp-json/batch/v1 HTTP/1.1" 207 631 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
Few hours later, someone is already running an automated script with a specific user-agent:
178.83.181.* - - [18/Jul/2026:20:46:25 +0200] "GET / HTTP/1.1" 200 46802 "-" "wp2shell-check/1.0" 178.83.181.* - - [18/Jul/2026:20:46:26 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 400 136 "-" "wp2shell-check/1.0"
During 2026-07-18 and 2026-07-19 we have 11 more script monkeys, most of them using seemingly legit user-agents:
87.58.197.* - - [18/Jul/2026:22:11:18 +0200] "POST /wp-json/batch/v1 HTTP/1.1" 207 631 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" 172.233.190.* - - [19/Jul/2026:00:57:28 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 13133 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 102.220.160.* - - [19/Jul/2026:04:39:14 +0200] "POST /wp-json/batch/v1 HTTP/1.1" 207 631 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 194.146.92.* - - [19/Jul/2026:06:56:38 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 631 "-" "wp2shell" 104.248.220.* - - [19/Jul/2026:13:16:40 +0200] "POST /wp-json/batch/v1 HTTP/1.1" 207 27 "-" "Mozilla/5.0 (compatible; MSIE 5.0; Windows NT 10.0; Trident/4.1)" 64.226.81.* - - [19/Jul/2026:13:16:54 +0200] "POST /wp-json/batch/v1 HTTP/1.1" 207 60369 "-" "Mozilla/5.0 (compatible; MSIE 5.0; Windows NT 10.0; Trident/4.1)" 168.144.176.* - - [19/Jul/2026:13:30:56 +0200] "POST /wp-json/batch/v1 HTTP/1.1" 207 27 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/531.2 (KHTML, like Gecko) Chrome/21.0.833.0 Safari/531.2" 134.122.43.* - - [19/Jul/2026:13:31:05 +0200] "POST /wp-json/batch/v1 HTTP/1.1" 207 60369 "-" "Mozilla/5.0 (iPad; CPU iPad OS 17_1_1 like Mac OS X) AppleWebKit/531.1 (KHTML, like Gecko) CriOS/45.0.805.0 Mobile/28P030 Safari/531.1" 104.248.220.* - - [19/Jul/2026:13:31:14 +0200] "POST /wp-json/batch/v1 HTTP/1.1" 207 387039 "-" "Mozilla/5.0 (iPad; CPU iPad OS 17_1_1 like Mac OS X) AppleWebKit/531.1 (KHTML, like Gecko) CriOS/45.0.805.0 Mobile/28P030 Safari/531.1" 205.185.113.* - - [19/Jul/2026:17:59:32 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 200 762 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
On 2026-07-19 20:53 UTC, attackers already have a fully automated script. Notice an attempt to drop a malicious PHP in /wp-content/cache/ folder, and then attempts to log in the WordPress admin interface:
15.204.114.* - - [19/Jul/2026:22:53:18 +0200] "GET / HTTP/1.1" 200 46783 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 15.204.114.* - - [19/Jul/2026:22:53:19 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 631 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" 15.204.114.* - - [19/Jul/2026:22:53:19 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 2874 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 15.204.114.* - - [19/Jul/2026:22:53:20 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 720 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" 15.204.114.* - - [19/Jul/2026:22:53:20 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 720 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 15.204.114.* - - [19/Jul/2026:22:53:21 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 720 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" 15.204.114.* - - [19/Jul/2026:22:53:22 +0200] "GET /wp-content/cache/vhcd5qmwvn4o.php?px=vhcd5qmwvn4o HTTP/1.1" 404 23855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 15.204.114.* - - [19/Jul/2026:22:53:22 +0200] "GET /wp-content/cache/vhcd5qmwvn4o.php?p=vhcd5qmwvn4o HTTP/1.1" 404 23855 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 15.204.114.* - - [19/Jul/2026:22:53:23 +0200] "GET /?rest_route=%2Fwp%2Fv2%2Fposts&per_page=1&_fields=link HTTP/1.1" 401 129 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" 15.204.114.* - - [19/Jul/2026:22:53:23 +0200] "GET /?rest_route=%2Fwp%2Fv2%2Fpages&per_page=1&_fields=link HTTP/1.1" 401 129 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" 15.204.114.* - - [19/Jul/2026:22:53:24 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 3062 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" 15.204.114.* - - [19/Jul/2026:22:53:24 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 3092 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" 15.204.114.* - - [19/Jul/2026:22:53:24 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 2950 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" 15.204.114.* - - [19/Jul/2026:22:53:25 +0200] "GET /wp-login.php HTTP/1.1" 302 0 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" 15.204.114.* - - [19/Jul/2026:22:53:26 +0200] "GET /wp-login.php HTTP/1.1" 200 4974 "http://lifeinhex.com/wp-login.php" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" 15.204.114.* - - [19/Jul/2026:22:53:26 +0200] "POST /wp-login.php HTTP/1.1" 302 0 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" 15.204.114.* - - [19/Jul/2026:22:53:27 +0200] "GET /wp-login.php HTTP/1.1" 200 4974 "http://lifeinhex.com/wp-login.php" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" 15.204.114.* - - [19/Jul/2026:22:53:27 +0200] "GET /wp-admin/ HTTP/1.1" 302 0 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" 15.204.114.* - - [19/Jul/2026:22:53:27 +0200] "GET /wp-login.php HTTP/1.1" 302 0 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" ... dozens more attempts to log in...
On 2026-07-20 the exploit is already added to multi-purpose exploit tool. Notice how the script tries to use wp2shell and then switches to scanning for known-vulnerable plugins (burst-statistics, miniOrange SAML SP Single Sign On, All In One SEO Pack, etc.)
64.181.197.* - - [20/Jul/2026:04:04:37 +0200] "GET /?rest_route=/ HTTP/1.1" 401 129 "-" "Mozilla/5.0" 64.181.197.* - - [20/Jul/2026:04:04:38 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 845 "-" "Python-urllib/3.12" ... 60 more attempts ... 64.181.197.* - - [20/Jul/2026:04:04:45 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 720 "-" "Python-urllib/3.12" 64.181.197.* - - [20/Jul/2026:04:04:45 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 1103 "-" "Python-urllib/3.12" 64.181.197.* - - [20/Jul/2026:04:04:45 +0200] "GET /?rest_route=/wp/v2/posts&per_page=1&_fields=link HTTP/1.1" 401 129 "-" "Python-urllib/3.12" 64.181.197.* - - [20/Jul/2026:04:04:46 +0200] "GET /?rest_route=/burst/v1 HTTP/1.1" 404 125 "-" "Mozilla/5.0" 64.181.197.* - - [20/Jul/2026:04:04:46 +0200] "HEAD /wp-content/plugins/miniorange-saml-20-single-sign-on/readme.txt HTTP/1.1" 404 0 "-" "Mozilla/5.0" 64.181.197.* - - [20/Jul/2026:04:04:46 +0200] "GET /wp-content/plugins/w3-total-cache/readme.txt HTTP/1.1" 404 23874 "-" "Mozilla/5.0" 64.181.197.* - - [20/Jul/2026:04:04:47 +0200] "HEAD /wp-content/plugins/all-in-one-seo-pack/readme.txt HTTP/1.1" 404 0 "-" "Mozilla/5.0" 64.181.197.* - - [20/Jul/2026:04:04:47 +0200] "HEAD /wp-content/plugins/all-in-one-wp-migration/readme.txt HTTP/1.1" 404 0 "-" "Mozilla/5.0" 64.181.197.* - - [20/Jul/2026:04:04:48 +0200] "HEAD /wp-content/plugins/wpvivid-backuprestore/readme.txt HTTP/1.1" 404 0 "-" "Mozilla/5.0" 64.181.197.* - - [20/Jul/2026:04:04:48 +0200] "HEAD /wp-content/plugins/updraftplus/readme.txt HTTP/1.1" 200 0 "-" "Mozilla/5.0"
What about you?
I was running a vulnerable WordPress version with disabled automatic updates.
However, I have WordPress REST API disabled as an additional security measure. Therefore I believe all attempts at exploitation failed, even though the web scanner thought my instance was vulnerable:
What do you think - was that skill or just luck? 🙂
hi kao any news for unpacker?
As far as I know, all unpackers are working just fine. Latest Enigma Virtual Box versions are not identified - but unpacker still works.
As always - if you have a specific file that is causing problems, please send it to me.
I used the latest version (0.63) to extract this game, but it didn't work. Could you please take a look and see what the problem might be?
{hidden link}
That's because your game is using a custom launcher by h-game18:
When you start the game, the launcher will create a ZIP file named
.rm_payload_{random_hex_digits}.zipin your TEMP folder. It contains a full game, no special unpacker needed. 🙂There will also be a hidden directory
.rm_cache_{random_hex_digits}in the TEMP folder - it contains the full game, as well as a custom savegame plugin calledAG_RuntimeSaveRedirect.jsThanks a lot! I never would have figured that out on my own. Your explanation made everything clear, and now I know exactly where to look. I really appreciate you taking the time to help. Thanks again!