WP2Shell (CVE-2026-63030): Behavioral Detection of the WordPress Core Pre-Auth RCE Chain with SentinelOne

Analysis of the CVE-2026-63030 "WP2Shell" pre-auth RCE vulnerability in WordPress Core from a Threat Hunting perspective using SentinelOne Deep Visibility: MITRE ATT&CK kill chain mapping, behavioral parent-child Deep Visibility query, and a 7-day Star Custom Rule simulation.

What is CVE-2026-63030?

It is a vulnerability affecting the core of WordPress, one of the most widely used content management systems, which under certain conditions can escalate to remote code execution (RCE) without authentication.

CVE-2026-63030 on its own is not a classic "file upload" flaw. A routing (route confusion) issue on the REST API batch endpoint can be chained with the SQL Injection vulnerability tracked as CVE-2026-60137 to lead to remote code execution (RCE). Following a successful RCE, because the attacker can execute PHP code, in practice it becomes possible to obtain a webshell.

CVE-2026-63030 has been classified as critical because it allows an attacker to execute code on the server through the WordPress application on exploited systems. Vulnerabilities that reach the remote code execution (RCE) level can put not only the application, but also the server on which the application runs and connected systems at risk.

With the successful exploitation of this vulnerability, an attacker can achieve persistence on the system by planting a webshell, execute malicious commands on the server, access sensitive data, or prepare the system for further attacks. Especially on internet-facing WordPress servers, such vulnerabilities can quickly be targeted by threat actors.

Kill Chain from the MITRE ATT&CK Perspective

1. An attacker targeting an internet-facing, affected WordPress server and exploiting the vulnerability. Initial Access T1190 — Exploit Public-Facing Application
2. Following a successful exploit, the attacker executes operating system commands by spawning shell processes such as sh or bash through PHP. Execution T1059.004 — Command and Scripting Interpreter: Unix Shell
3. The attacker uploads a webshell to the server and obtains persistent access to the system. Persistence T1505.003 — Server Software Component: Web Shell
4. Cron jobs are created on the system in order to strengthen persistence. Persistence T1053.003 — Scheduled Task/Cron
5. The webshell or malicious files are named to resemble legitimate WordPress files. Defense Evasion T1036 — Masquerading
6. Operating system details, PHP version, and server information are collected. Discovery T1082 — System Information Discovery
7. The collected data is exfiltrated to an external environment over the existing C2 channel. Exfiltration T1041 — Exfiltration Over C2 Channel

Affected WordPress Versions

CVE-2026-63030 affects certain WordPress core versions. According to the published security bulletins, the following versions are affected:

Affected versions

1. WordPress 6.9.0 - 6.9.4
2. WordPress 7.0.0 - 7.0.1

Since the relevant vulnerability resides in the WordPress core, it does not depend on any plugin or theme. Systems running the affected versions are potentially at risk unless the necessary security updates are applied.

For the CVE-2026-63030 vulnerability, applying security updates alone may not be sufficient compared to other vulnerabilities. In order to determine whether an exploit occurred before the patch was applied, log analysis on the security tools in use, Threat Hunting, and inspection of process, file, and network activities via EDR telemetry are of great importance.

As an MDR Analyst, in this article I will examine Deep Visibility queries on the widely used SentinelOne EDR product, along with the blocking rule related to the aforementioned vulnerability.

Threat Hunting with SentinelOne Deep Visibility

Following the exploitation of CVE-2026-63030, the activities performed by the attacker on the system leave traces on behavioral EDRs such as Process Creation, File Creation, Network Connection, and Command Execution. SentinelOne Deep Visibility enables these behaviors to be analyzed thanks to the telemetry data collected on the endpoint. In the test carried out in a virtual environment, SentinelOne did not generate any automatic alerts throughout the attack. On the other hand, the activities belonging to the attack could be viewed as raw telemetry records in Deep Visibility. This situation highlights the difference between detection and visibility.

To examine the logs left by the relevant activities on the EDR, I share the Deep Visibility query and its output below:

This query aims to catch a behavior that a web server process would not normally exhibit: with the src.process.parent.name condition, web server/PHP handler processes such as php-fpm, nginx, apache2, and httpd are targeted as the parent process, while with the src.process.name condition, command-line interpreters such as sh, bash, dash, zsh, and ash; network tools such as curl, wget, nc, ncat, and socat; and scripting interpreters such as python, python3, and perl that these processes launch as child processes are filtered. Since in a legitimate operating scenario a web server is not expected to directly execute a shell or a network tool, the occurrence of this parent-child relationship indicates attacker activity following a command injection or remote code execution (RCE); therefore, this query surfaces, through Deep Visibility telemetry, the behavioral traces of CVE-2026-63030 exploitation that are not converted into alerts by SentinelOne.

The targets of the query above, which detects different critical activities, are:

1. To detect interactive shell access obtained via command injection or a webshell by catching web server processes (php-fpm, nginx, apache2, httpd) spawning a command-line interpreter such as sh, bash, dash, zsh, or ash as a child process.
2. To reveal reverse shell or listener-based command-and-control connections that the attacker attempts to establish on the system, by monitoring the launch of network tools such as nc, ncat, and socat by the web server.
3. To identify the attacker's attempts to download additional malware, exploits, or scripts from external sources by detecting the execution of tools such as curl and wget under a web server process.
4. To spot the attacker's activities aimed at running additional code, privilege escalation, or persistence by monitoring the launch of interpreters such as python, python3, and perl by the web server.

Note: Behaviors detected with SentinelOne Deep Visibility can be defined as a Star Custom Rule if they recur. However, since the first stage of CVE-2026-63030 takes place at the HTTP layer, SentinelOne is not a WAF that directly blocks this request. SentinelOne's actual purpose and role will be to detect behaviors such as web shell, command execution, file creation, and C2 communication that occur after a successful exploit, and to respond to them with appropriate policies.

When I defined the query created in the SentinelOne Deep Visibility section as a Star Custom Rule and ran a 7-day simulation, it was observed that the relevant rule produced 26 alerts within the scope of the test. As a result of this simulation, the rule was assessed to have successfully detected anomalous activities.

Melike TÜNCAZ — L1 MDR Analyst

InfinitumIT MDR — Detection Engineering & Threat Hunting

This article is based on Deep Visibility observations conducted in a controlled SentinelOne test environment and on the results of a 7-day Star Custom Rule simulation. The queries and recommendations presented are illustrative in nature.