WP2Shell

Overview

WP2Shell is a critical Remote Code Execution (RCE) vulnerability affecting WordPress versions 6.9.0 through 7.0.1. This exploit chain leverages an authentication bypass, SQL injection, and privilege escalation to achieve pre-authentication RCE. The vulnerability allows an unauthenticated attacker to create an administrator account and execute arbitrary commands on the target WordPress instance.

Affected Versions

Version Range	Status
<= 6.8.5	Not affected
6.9.0 – 6.9.4	Affected
7.0.0 – 7.0.1	Affected

Technical Analysis

Root Cause: Route Confusion in Batch API

The vulnerability stems from a desynchronization issue in the WordPress REST API batch endpoint /batch/v1. This endpoint is unauthenticated and processes multiple sub-requests in a single call. The flaw occurs in serve_batch_request_v1() function:

1. The function builds two parallel arrays:
   • $matches: Stores matched handlers for each sub-request
   • $validation: Stores validation results for each sub-request

2. When a sub-request path fails wp_parse_url(), it's appended to $validation but not to $matches, causing the arrays to become misaligned.

3. This misalignment leads to a sub-request being dispatched under a different sub-request's handler, creating a route confusion vulnerability.

Exploitation Chain

The exploit chain consists of six distinct phases:

Phase 1: Route Confusion & SQL Injection

• A POST request to /wp/v2/posts is dispatched under the batch handler

• The inner batch bypasses the method allow-list using a GET request to /wp/v2/posts/999999

• This triggers a blind SQL injection via the author_exclude parameter

Phase 2: UNION-Based SQL Injection

• Uses UNION queries to inject fake wp_posts rows

• Renders attacker-controlled content through the posts collection

• The render bridge uses the vulnerable item-route to reach get_items()

Phase 3: oEmbed Cache Creation

• Exploits the render capability to create real oEmbed cache posts

• Recover cache post IDs through the SQL injection

Phase 4: Customizer Bridge

• Recasts the IDs as:
  • Customizer changeset
  • Navigation item
  • Request hook shape

Phase 5: Administrator Creation

• The same request reaches POST /wp/v2/users

• Creates a generated administrator account

Phase 6: Command Execution

• Authenticates using the created admin account

• Uploads a plugin containing a webshell

• Executes arbitrary commands

Proof of Concept Exploitation

https://github.com/Icex0/wp2shell-poc

Scan with wpscan to get WordPress Version

wpscan --url http://10.0.0.5/wordpress

Clone the repo

git clone https://github.com/Icex0/wp2shell-poc

Command Execution

python3 wp2shell.py shell http://10.0.0.5/wordpress -i --timeout 60

Impact Assessment

Severity: Critical

• CVSS Score: 9.8 (Critical)

• Attack Vector: Network

• Attack Complexity: Low

• Privileges Required: None

• User Interaction: None

• Confidentiality Impact: High

• Integrity Impact: High

• Availability Impact: High

What's at Risk

1. Complete System Compromise: Attackers gain full control of the WordPress instance

2. Data Theft: Database contents can be extracted

3. Server Pivot: WordPress server can be used as entry point to internal networks

4. Defacement: Website content can be modified

5. Malware Distribution: Site can be used to distribute malware

Mitigation Strategies

Immediate Actions

1. Update WordPress to the latest patched version (7.0.2+)

2. Disable REST API if not required:

   add_filter('rest_authentication_errors', function($result) {
       if (!is_user_logged_in()) {
           return new WP_Error('rest_forbidden', 'REST API restricted', array('status' => 401));
       }
       return $result;
   });

Long-term Recommendations

1. Implement Web Application Firewall (WAF) to detect and block exploitation attempts

2. Regular Security Audits: Conduct periodic vulnerability assessments

3. Least Privilege Principle: Ensure WordPress filesystem permissions are properly restricted

4. Monitoring: Implement logging and monitoring for suspicious REST API activity

5. Backup Strategy: Maintain regular backups for quick recovery

Detection Indicators

Monitor for:

• Unusual POST requests to /batch/v1

• Requests containing author_exclude parameter with SQL-like values

• Multiple concurrent requests to /wp/v2/posts/999999

• Creation of accounts with wp2_ prefix

• Unexpected user registration events

Conclusion

WP2Shell represents a critical vulnerability in WordPress that enables complete system compromise without authentication. The exploit chain demonstrates sophisticated exploitation techniques, including route confusion, SQL injection, and privilege escalation. Organizations running affected versions should prioritize patching and implement the recommended security measures immediately.