Cách đây hai tuần, WordPress 7.0.2 va chạm hai lỗ hổng nghiêm trọng CVE-2026-63030 va CVE-2026-60137 — chain khai thac ten “wp2shell”. Nhieu ban đa cap nhat xong va nghi “oke, xong roi”. Nhung CISA vua them vao KEV Catalog ngay 21/7, PoC cong khai tren GitHub, va dut nguoc: site cua ban co chac chua bi hit TRUOC khi patch?
Trong bai nay, minh se huong dan ban tung buoc kiem tra xem site WordPress cua ban co dau vet khai thac wp2shell hay khong, tu forensic database checks den file system scan, va phai lam gi neu phat hien bi compromise.
wp2shell La Gi Va Vi Sao CISA Phai Canh Bao?
wp2shell la chain hai lo hong trong WordPress Core: CVE-2026-63030 (REST API batch-route confusion) ket hop CVE-2026-60137 (SQL injection trong WP_Query). Kết quả: attacker khong can login, khong can plugin, khong can theme — chi can mot default WordPress install la co the achieve full RCE.
CISA them vao Known Exploited Vulnerabilities (KEV) Catalog ngay 21/7/2026, nghia la co khai thac thuc te (in-the-wild) da xac nhan. Public PoC da len GitHub ngay sau disclosure, va bat ky script kiddie nao cung co the chay.
Cac Phiên Bản Nao Bi Anh Huong?
Ban can biet chinh xac phien ban nao de danh gia rui ro:
| Phiên ban WordPress | Muc do exposure | Da patch trong |
|---|---|---|
| 6.8.0 – 6.8.5 | SQL injection (khong RCE) | 6.8.6 |
| 6.9.0 – 6.9.4 | Full RCE chain | 6.9.5 |
| 7.0.0 – 7.0.1 | Full RCE chain | 7.0.2 |
| 7.0.2 tro len | Khong bi anh huong | — |
Nếu site của bạn đang chạy 7.0.2 trở lên, bạn đã an toàn với vulnerability này. Nhưng điều đó không có nghĩa là site chưa bị tấn công TRƯỚC khi patch được áp dụng.
Buoc 1: Kiem Tra Phien Ban WordPress Hien Tai
Dau tien, ban can xac nhan phien ban WordPress dang chay. Dung WP-CLI cho nhanh:
sudo -u www-data wp core version --path=/var/www/yourdomain.com/public_htmlHoac kiem tra truc tiep trong file wp-includes/version.php:
grep "wp_version " /var/www/yourdomain.com/public_html/wp-includes/version.phpNếu kết quả trả về nhỏ hơn 7.0.2 (hoặc 6.9.5 / 6.8.6), bạn cần update NGAY LAP TUC truoc khi lam bat ky kiem tra forensics nao:
sudo -u www-data wp core update --path=/var/www/yourdomain.com/public_htmlBuoc 2: Kiem Tra Database Tim Dau Vet Khai Thac
Day la phan quan trong nhat. wp2shell de lai artifacts trong database, dac biet la trong cac bang wp_postmeta va wp_posts. Minim se chay cac query sau:
2.1. Kiem tra oEmbed cache rows bat thuong:
wp2shell su dung oEmbed cache de luu payload. Cac rows nay co the chua du lieu inject:
sudo -u www-data wp db query \
"SELECT post_id, meta_key, LEFT(meta_value, 200) AS preview \
FROM wp_postmeta \
WHERE meta_key LIKE '_oembed_%' \
AND meta_value NOT REGEXP '^<' \
AND meta_value NOT REGEXP 'https?://' \
ORDER BY post_id DESC \
LIMIT 50;" \
--path=/var/www/yourdomain.com/public_htmlCác oEmbed cache bình thường sẽ chứa HTML embed code hoặc URL. Nếu bạn thấy dữ liệu binary, serialized objects, hoặc chuỗi lạ, đó là dấu hiệu đáng ngờ.
2.2. Tim changeset posts va customizer request posts:
sudo -u www-data wp db query \
"SELECT ID, post_type, post_status, post_date, post_author \
FROM wp_posts \
WHERE post_type IN ('customize_changeset', 'customize_request') \
AND post_date >= '2026-07-01 00:00:00' \
ORDER BY post_date DESC;" \
--path=/var/www/yourdomain.com/public_htmlPoC wp2shell tao changeset posts de inject rogue administrator. Neu ban thay changeset posts ma ban khong tao (khong co customization action nao tren site), can than.
2.3. Kiem tra users admin bat thuong:
sudo -u www-data wp db query \
"SELECT ID, user_login, user_email, user_registered, user_status \
FROM wp_users \
WHERE user_registered >= '2026-07-01 00:00:00' \
ORDER BY user_registered DESC;" \
--path=/var/www/yourdomain.com/public_htmlwp2shell PoC tu clean up rogue admin user, nhung nhieu variant khong. Neu ban thay user admin moi ma ban khong tao, day la red flag lon.
Buoc 3: Scan File System Tim Webshell
Sau khi gain RCE, attacker thuong upload webshell de duy tri access. Cac file nay thuong nam trong wp-content/uploads/, wp-content/plugins/, hoac wp-content/themes/.
3.1. Tim PHP files trong uploads directory:
find /var/www/yourdomain.com/public_html/wp-content/uploads/ \
-name "*.php" -type f 2>/dev/nullKhong co PHP file nao hop le nam trong uploads. Bat ky file .php nao o day deu la webshell hoac malware.
3.2. Tim files bi modify gan day:
find /var/www/yourdomain.com/public_html/ \
-name "*.php" -type f \
-newermt "2026-07-01" \
! -path "*/cache/*" \
! -path "*/node_modules/*" \
-ls 2>/dev/null | head -503.3. Kiem tra cac file core cua WordPress:
sudo -u www-data wp core verify-checksums \
--path=/var/www/yourdomain.com/public_htmlLenh nay se kiem tra moi file core co khop voi official release khong. Neu co file bi modify, no se bao loi.
Buoc 4: Kiem Tra Access Logs Tim Request Khai Thac
wp2shell trien khai qua REST API batch endpoint. Cac request khai thac se co dac diet:
grep -E "/wp-json/batch/v1|rest_route=/batch/v1" \
/var/log/nginx/yourdomain.com.access.log \
| grep "POST" \
| awk '{print $1, $7, $9}' \
| head -30Nếu bạn thấy nhiều POST requests liên tục đến /wp-json/batch/v1 cùng thời điểm (hàng chục request trong vài phút), đó có thể là dấu hiệu khai thác. Tuy nhiên,Batch API cũng được sử dụng hợp lệ, nên cần kết hợp với các dấu hiệu khác.
Kiem tra user-agent bat thuong:
grep "/wp-json/batch/v1" \
/var/log/nginx/yourdomain.com.access.log \
| awk -F'"' '{print $6}' \
| sort | uniq -c | sort -rn | head -10Tool khai thac thuong dung curl, python-requests, hoac Go-http-client. Neu ban thay nhieu request tu cac user-agent nay, phai investigated.
Buoc 5: Dung Compromise Scanner Plugin
Eye Security da phat trien free plugin “Compromise Scanner for wp2shell” va dang len WordPress.org plugin repository. Plugin nay scan database tim cac forensics artifacts dac trung cua wp2shell.
Cai dat va chay:
sudo -u www-data wp plugin install compromise-scanner-for-wp2shell \
--activate \
--path=/var/www/yourdomain.com/public_htmlSau do vao Tools > wp2shell Scanner trong wp-admin de chay scan. Plugin se kiem tra:
- oEmbed cache rows bat thuong
- Changeset posts khong hop le
- Rogue administrator accounts
- Webshell files trong wp-content
Ngoai ra, ban cung co dung free browser extension “wp2shell Checker” tu Chrome Web Store de quick check nhanh mot site bat ky.
Neu Phat Hien Bi Compromise: Phai Lam Gi?
Nếu sau các bước trên bạn phát hiện dấu hiệu khai thác, đừng panik. Minh se huong dan ban xu ly tung buoc:
Buoc 1: Isolate site ngay lap tuc.
# Put site vao maintenance mode
sudo -u www-data wp maintenance-mode activate \
--path=/var/www/yourdomain.com/public_html
# Block tat ca traffic tru admin IP
sudo iptables -A INPUT -p tcp --dport 443 \
! -s YOUR_ADMIN_IP -j DROPBuoc 2: Reset tat ca user passwords.
# Reset password cho tat ca users
sudo -u www-data wp user list \
--field=ID \
--path=/var/www/yourdomain.com/public_html \
| xargs -I {} wp user update {} \
--user_pass=$(openssl rand -base64 24) \
--path=/var/www/yourdomain.com/public_htmlSQL injection co the da doc duoc wp_users table, nghia la attacker co the giu password hashes. Reset toan bo la bat buoc.
Buoc 3: Revoke tat ca sessions va API keys.
# Xoa tat ca active sessions
sudo -u www-data wp db query \
"TRUNCATE TABLE wp_usermeta WHERE meta_key = 'session_tokens';" \
--path=/var/www/yourdomain.com/public_html
# Revoke application passwords
sudo -u www-data wp db query \
"DELETE FROM wp_usermeta WHERE meta_key = 'application_passwords';" \
--path=/var/www/yourdomain.com/public_htmlBuoc 4: Remove webshell va malicious files.
# Xoa PHP files trong uploads
find /var/www/yourdomain.com/public_html/wp-content/uploads/ \
-name "*.php" -type f -delete
# Re-download core files
sudo -u www-data wp core download --force \
--path=/var/www/yourdomain.com/public_htmlBuoc 5: Reinstall plugins va themes tu source.
# List activated plugins
sudo -u www-data wp plugin list --status=active \
--field=name \
--path=/var/www/yourdomain.com/public_html
# Reinstall tung plugin
sudo -u www-data wp plugin reinstall plugin-name \
--path=/var/www/yourdomain.com/public_htmlCach Ngan Ngừa Tương Lai: Block REST API Batch Endpoint
Nếu ban chua can update ngay duoc (vi ly do nao do), hay block batch endpoint ngay:
Voi Nginx:
# Them vao server block
location ~* ^/wp-json/batch/v1 {
deny all;
return 403;
}
# Block ca query parameter variant
if ($args ~* "rest_route=/batch/v1") {
return 403;
}Voi Cloudflare WAF (free plan):
Tao Firewall Rule moi:
((http.request.uri.path contains "/wp-json/batch/v1") or (http.request.uri.query contains "rest_route=/batch/v1"))
Action: Block. Day la cach nhanh nhat de cat duong khai thac ma khong anh huong functionality.
Tom Lai: Checklist Incident Response wp2shell
Minh tong hop lai cac buoc can lam:
- Kiem tra phien ban — dam bao dang chay 7.0.2 tro len
- Scan database — tim oEmbed cache rows, changeset posts, rogue admins
- Scan file system — PHP files trong uploads, core checksums
- Kiem tra access logs — POST requests den batch endpoint
- Chay Compromise Scanner plugin — free tool tu Eye Security
- Neu bi compromise: isolate, reset passwords, revoke sessions, remove malware, reinstall
- Block batch endpoint — defense in depth cho tuong lai
wp2shell la reminder rat nong rang: core vulnerabilities khong phai chuyen moc mac. Hai CVE nay khong can plugin, khong can theme, khong can login — chi can mot WordPress instance reachable la du. Neu ban chua patch, hay lam NGAY. Neu da patch roi, hay kiem tra xem site da bi hit truoc do chua.
Co cau hoi nao ve incident response wp2shell? De lai comment ben duoi, minh se giup.
