{"id":39629,"date":"2026-07-27T22:21:15","date_gmt":"2026-07-27T15:21:15","guid":{"rendered":"https:\/\/dps.media\/lo-hong-wp2shell-wordpress\/"},"modified":"2026-07-27T22:21:15","modified_gmt":"2026-07-27T15:21:15","slug":"vulnerability-wp2shell-wordpress","status":"publish","type":"post","link":"https:\/\/dps.media\/en\/vulnerability-wp2shell-wordpress\/","title":{"rendered":"WordPress wp2shell Vulnerability (CVE-2026-63030): Guide to Scanning &amp; Bulk Malware Cleanup for Servers in 2026"},"content":{"rendered":"<?xml encoding=\"utf-8\" ?><p>Vulnerability <strong>wp2shell WordPress<\/strong> (CVE-2026-63030) has just erupted and is now the leading threat to millions of WordPress websites worldwide. This is an RCE (Remote Code Execution) vulnerability that allows attackers to take control of the server without logging in. Although WordPress has released patches 7.0.2 \/ 6.9.5 \/ 6.8.6, simply clicking the Core upgrade button is <strong>not enough<\/strong> to clean up hidden accounts and webshells that were previously injected.<\/p><p>This post shares a practical, real-world workflow to help you thoroughly audit, completely clean malware, and safely upgrade large numbers of Linux servers (CyberPanel, cPanel, DirectAdmin) without causing service disruption.<\/p><h2>What is the WordPress wp2shell vulnerability and why is upgrading alone not enough?<\/h2><p>Vulnerability <strong><a href=\"https:\/\/dps.media\/en\/vulnerability-wp2shell-wordpress\/\">WordPress wp2shell Vulnerability<\/a><\/strong> occurs in the REST API layer, allowing hackers to execute remote code. Immediately after the PoC appeared, automated scanning waves worldwide inserted hidden Admin accounts and webshells into sites that had not yet been patched.<\/p><p>Many administrators mistakenly believe that simply clicking the \u201cUpdate WordPress\u201d button is enough. In reality, a WordPress update only patches the initial vulnerability, but <strong>do not delete<\/strong> webshell files or rogue accounts have been created in the Database. If these traces are not completely removed, the hacker can still regain access at any time.<\/p><p><img decoding=\"async\" src=\"https:\/\/dps.media\/wp-content\/uploads\/2026\/07\/lo_hong_wp2shell_wordpress_cve_2026_6303_img2-scaled.png\" alt=\"WordPress wp2shell Vulnerability\" style=\"display:block;margin:20px auto;max-width:100%;height:auto\" title=\"\"><\/p><h2>Signs of wp2shell malware identification on the Server<\/h2><p>When inspecting a server, wp2shell malware typically leaves behind the following three groups of characteristic indicators:<\/p><ul>\n<li><strong>Hidden Admin Account in the Database:<\/strong> Usernames with the prefix <code data-no-translation=\"\">wpsvc_<\/code>, <code data-no-translation=\"\">wp2_<\/code>, <code data-no-translation=\"\">w2s_<\/code>, <code data-no-translation=\"\">wp_admin_<\/code> or an email ending with <code data-no-translation=\"\">@wp2shell.*<\/code>, <code data-no-translation=\"\">@wordpress-svc.internal<\/code>, <code data-no-translation=\"\">@wordpress-noreply.net<\/code>.<\/li>\n<li><strong>Plugin-disguised Webshell:<\/strong> The directories are located in <code data-no-translation=\"\">wp-content\/plugins\/<\/code> named with a random hex string such as <code data-no-translation=\"\">media-optimization-core-8ed2ad<\/code>, <code data-no-translation=\"\">security-headers-manager-2a70a3<\/code> contains a small PHP file exploited through parameters <code data-no-translation=\"\">?c=<\/code>.<\/li>\n<li><strong>Hidden file in mu-plugins:<\/strong> The PHP files are located at <code data-no-translation=\"\">wp-content\/mu-plugins\/<\/code> (such as <code data-no-translation=\"\">wp-fixplugin.php<\/code>) runs silently to automatically recreate the rogue Admin account whenever it is deleted.<\/li>\n<\/ul><h2>4-step process to audit &amp; clean up wp2shell in bulk<\/h2><h3>Step 1: Quickly scan hidden accounts using MySQL Root<\/h3><p>Instead of running WP-CLI to load a resource-intensive PHP environment, directly querying the MySQL Root helps you scan hundreds of websites in just 2-3 seconds without worrying about permission errors:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">for dir in \/home\/*\/public_html; do\n  if [ -f \"$dir\/wp-config.php\" ]; then\n    domain=$(basename $(dirname \"$dir\"))\n    dbname=$(grep -E \"DB_NAME\" \"$dir\/wp-config.php\" | cut -d'\"' -f4)\n    prefix=$(grep -E \"table_prefix\" \"$dir\/wp-config.php\" | cut -d'\"' -f2)\n    [ -z \"$prefix\" ] && prefix=\"wp_\"\n    \n    if [ ! -z \"$dbname\" ]; then\n      result=$(mysql --batch --skip-column-names -e \"USE \\`$dbname\\`; SELECT CONCAT('ID: ', u.ID, ' | User: ', u.user_login, ' | Email: ', u.user_email) FROM \\`${prefix}users\\` u JOIN \\`${prefix}usermeta\\` m ON u.ID = m.user_id WHERE m.meta_key = '${prefix}capabilities' AND m.meta_value LIKE '%administrator%' AND (u.user_login REGEXP '^w2s_|^wp_admin_|^wp2_|^wpsvc_|^wp2shell' OR u.user_email REGEXP '\\\\.invalid|\\\\.local$|internal|wp2shell|shellcode');\" 2>\/dev\/null)\n      if [ ! -z \"$result\" ]; then\n        echo \"=== \u26a0\ufe0f  Ph\u00e1t hi\u1ec7n Admin m\u00e3 \u0111\u1ed9c tr\u00ean $domain (DB: $dbname) ===\"\n        echo \"$result\"\n      fi\n    fi\n  fi\ndone<\/code><\/pre><h3>Step 2: Use the official wp2shell-scan tool to isolate Webshell<\/h3><p>Tools <a href=\"https:\/\/github.com\/InstaWP\/wp2shell-scan\" target=\"_blank\" rel=\"noopener nofollow\">official wp2shell-scan from InstaWP<\/a> help you move detected webshell files into the quarantine folder (Quarantine) and change the SALT security salt code:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">curl -fsSLO https:\/\/raw.githubusercontent.com\/InstaWP\/wp2shell-scan\/main\/wp2shell-scan.sh\nchmod +x wp2shell-scan.sh\n.\/wp2shell-scan.sh --path \/home\/domain-bi-dinh.com\/public_html --clean --yes<\/code><\/pre><h3>Step 3: Fix permissions &amp; Upgrade WordPress Core following SysAdmin standards<\/h3><p>On CyberPanel or LiteSpeed servers, the command <code data-no-translation=\"\">sudo -u<\/code> often has missing errors <code data-no-translation=\"\">mysqli<\/code> red <code data-no-translation=\"\">\/usr\/bin\/php<\/code> is limited. We need to directly specify the LiteSpeed PHP version (like <code data-no-translation=\"\">lsphp81<\/code>) to safely upgrade under the user account:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">for dir in \/home\/*\/public_html; do\n  if [ -f \"$dir\/wp-config.php\" ]; then\n    domain=$(basename $(dirname \"$dir\"))\n    owner=$(stat -c '%U' \"$dir\")\n    echo \"==========================================\"\n    echo \"\ud83d\udd04 Updating: $domain (User: $owner)\"\n    echo \"==========================================\"\n    \n    mkdir -p \"$dir\/wp-content\/upgrade\"\n    chown -R \"$owner:$owner\" \"$dir\/wp-content\/upgrade\"\n    chmod 755 \"$dir\/wp-content\/upgrade\"\n    \n    sudo -u \"$owner\" \/usr\/local\/lsws\/lsphp81\/bin\/php \/usr\/bin\/wp core update --path=\"$dir\" --skip-plugins --skip-themes 2>&1 | grep -viE \"<|translation|b\u1ea3n d\u1ecbch\"\n  fi\ndone<\/code><\/pre><h3>Step 4: Check the version again after upgrading<\/h3><p>Finally, run the quick script to check the entire website version to ensure 100% of the website pages have safely been upgraded to WordPress 7.0.2:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">for dir in \/home\/*\/public_html; do\n  if [ -f \"$dir\/wp-config.php\" ]; then\n    domain=$(basename $(dirname \"$dir\"))\n    version=$(grep '$wp_version =' \"$dir\/wp-includes\/version.php\" 2>\/dev\/null | cut -d'\"' -f2)\n    printf \"%-35s : %s\\n\" \"$domain\" \"${version:-N\/A}\"\n  fi\ndone<\/code><\/pre><h2>Important notes to avoid malware reinfection<\/h2><p>Cleaning up the running system is only half the journey. You need to take the following additional precautions to fully protect your website:<\/p><ul>\n<li><strong>Clean the entire Backup\/Snapshot file:<\/strong> If you restore from a backup created while the website was infected, the system will be reinfected with malware immediately. Please use the flag <code data-no-translation=\"\">--sql backup.sql<\/code> to check the backup file before restoring.<\/li>\n<li><strong>Avoid accidentally scanning real accounts:<\/strong> Should not use keywords <code data-no-translation=\"\">shell<\/code> Common when scanning SQL because it will mistakenly scan valid user accounts with English names such as Shelley, Shelly, Shellie.<\/li>\n<li><strong>Contact professional services:<\/strong> If the large system has many complex servers, use the solution <a href=\"https:\/\/dps.media\/en\/\">high-quality Digital Marketing services of DPS.MEDIA<\/a> and optimize the infrastructure to receive the most comprehensive system security support.<\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>A comprehensive guide to identifying, auditing, and completely cleaning the wp2shell vulnerability (CVE-2026-63030) on WordPress across multiple cPanel, CyberPanel, and DirectAdmin servers in 2026.<\/p>","protected":false},"author":0,"featured_media":39909,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2261,1933,1204],"tags":[],"class_list":["post-39629","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-tech","category-wordpress-marketing"],"acf":[],"rankmath_keywords":{"primary":"L\u1ed7 h\u1ed5ng wp2shell WordPress","secondary":[""]},"yoast_keywords":{"primary":"","secondary":[]},"yoast_focuskw":"","rankmath_focuskw":"L\u1ed7 h\u1ed5ng wp2shell WordPress","seo_keywords":{"primary":"L\u1ed7 h\u1ed5ng wp2shell WordPress","secondary":[""]},"_links":{"self":[{"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/posts\/39629","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/comments?post=39629"}],"version-history":[{"count":0,"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/posts\/39629\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/media\/39909"}],"wp:attachment":[{"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/media?parent=39629"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/categories?post=39629"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/tags?post=39629"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}