WordPress wp2shell Plugin Webshell Access via wp-content/plugins URL Path

Alert on HTTP requests targeting the wp2shell WordPress plugin path used for webshell execution/persistence.

FreeReviewedSigma · Critical · v5

Category: webserver
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-07-19
Updated: 2026-07-31

ATT&CK techniques

Persistence

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1505.003Web Shell
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags webserver requests whose URI path contains a wp2shell plugin directory under /wp-content/plugins/wp2shell_. Such access is indicative of using the wp2shell webshell for command execution and potential persistence after compromise. It relies on HTTP request telemetry, specifically the requested URI stem and (optionally) absence of a query string.

Reporting behind it

Related detections9 linkedT1505.003 — drag to rearrange

Suspicious SD-WAN Compromise JSP Webshell Access

Malicious AquaShell Webshell Access on Cisco Secure Email Gateway by UAT-9686

Malicious IIS Worker Process Spawning Command Shell Reconnaissance

Malicious StyleSmuggler (CVE-2026-75650) Web Shell Dropped In Magento Product Image Cache (via file_event)

Suspicious Web Shell File Written to IIS wwwroot Directory

Possible Citrix ShareFile Unauthenticated Upload Path Traversal Webshell (CVE-2023-24489) (via webserver)

Possible Unauthenticated Admin Creation in Dynamicweb CVE-2022-25369

Possible DotCMS Path Traversal Webshell Upload via content API CVE-2022-26352

Possible Avaya Aura Device Services WebDAV PHP Webshell Upload via PhoneBackup (via webserver)

WordPress wp2shell Plugin Webshell Access via wp-content/plugins URL Path

Pivot detection · T1505.003 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

wordpress-wp2shell-webshell-plugin-path-access-webserver-c9e6f412

title: WordPress wp2shell Plugin Webshell Access via wp-content/plugins URL Path
id: 1e678c24-39f4-44ce-be9e-da43844f300b
status: experimental
description: This rule flags webserver requests whose URI path contains a wp2shell plugin directory under /wp-content/plugins/wp2shell_. Such access is indicative of using the wp2shell webshell for command execution and potential persistence after compromise. It relies on HTTP request telemetry, specifically the requested URI stem and (optionally) absence of a query string.
references:
  - https://github.com/Icex0/wp2shell-poc
  - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
  - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_webshell_plugin_access.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-07-19
tags:
  - attack.execution
  - attack.persistence
  - attack.t1505.003
  - cve.2026-63030
  - cve.2026-60137
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: /wp-content/plugins/wp2shell_
  filter_optional_null_query:
    cs-uri-query: null
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: c9e6f412-3d50-4f7e-bf94-5b6c7d8e9f0a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL