Rule Info
Name
WordPress Wp2shell Exploitation Tool User-Agent
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects the hardcoded "wp2shell" User-Agent string used by the wp2shell
PoC tool during all phases of CVE-2026-63030 and CVE-2026-60137 exploitation.
Reference
Date
2026-07-19 00:00:00
Modified
None
Id
a7c4e2f9-1b38-4d5c-9e72-3f4a5b6c7d8e
Tags
attack.initial-access attack.t1190 cve.2026-63030 cve.2026-60137 detection.emerging-threats
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Swachchhanda Shrawan Poudel
Merge PR #6155 from @swachchhanda000 - Add WordPress Wp2shell Detections
2026-07-20
Scan your endpoints, forensic images or collected files with our portable scanner THOR