WordPress wp2shell Webshell Plugin Path Access (webserver)

title: WordPress wp2shell Webshell Plugin Path Access (webserver)
id: 1e678c24-39f4-44ce-be9e-da43844f300b
status: experimental
description: This rule flags webserver requests whose URI path contains /wp-content/plugins/wp2shell_. Such access indicates an attempt to use the wp2shell webshell plugin for command execution and potential persistence after compromise. It relies on HTTP request telemetry, specifically the requested URI stem and query presence/absence handling.
references:
  - https://github.com/Icex0/wp2shell-poc
  - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
  - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_webshell_plugin_access.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-07-19
tags:
  - attack.execution
  - attack.persistence
  - attack.t1505.003
  - cve.2026-63030
  - cve.2026-60137
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: /wp-content/plugins/wp2shell_
  filter_optional_null_query:
    cs-uri-query: null
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: c9e6f412-3d50-4f7e-bf94-5b6c7d8e9f0a
    type: derived