regarding CVE-2026-63030 / CVE-2026-60137

[shanti]

Hello,

I had a dissapointing moment lately where a customer's wordpress (7.0.1) had been hacked by the infamous webshell (circling around)

quick symptoms were:

• email-bounces
• at least private_html/.htaccess was set immuteable
• several .htaccess-files planted everwhere over public_html
• i have seen files created outside of public_html :-o

~/domains/filefuns.php

(which gives me the creeps)

• several new wp-users

$ wp user list

+----+-----------------+-----------------+-----------------------------+---------------------+------------------+
| ID | user_login      | display_name    | user_email                  | user_registered     | roles            |
+----+-----------------+-----------------+-----------------------------+---------------------+------------------+
| 15 | Nx_2219b90b8401 | Nx_2219b90b8401 | [email protected]  | 2026-07-23 00:53:09 | administrator    |
| 18 | Nx_246c412408f3 | Nx_246c412408f3 | [email protected]  | 2026-07-23 06:19:34 | administrator    |
| 11 | Nx_2d86913dae7f | Nx_2d86913dae7f | [email protected]  | 2026-07-22 16:11:13 | administrator    |
| 19 | Nx_469a97b1c49a | Nx_469a97b1c49a | [email protected]  | 2026-07-23 10:11:52 | administrator    |
| 9  | Nx_5b27e4ed9005 | Nx_5b27e4ed9005 | [email protected]  | 2026-07-22 05:08:42 | administrator    |
| 12 | Nx_7da4145078db | Nx_7da4145078db | [email protected]  | 2026-07-22 20:21:52 | administrator    |
| 10 | Nx_d9376bb5188c | Nx_d9376bb5188c | [email protected]  | 2026-07-22 15:30:10 | administrator    |
| 13 | Nx_dc282526b447 | Nx_dc282526b447 | [email protected]  | 2026-07-22 23:33:14 | administrator    |
| 16 | Nx_e2d1e93367bc | Nx_e2d1e93367bc | [email protected]  | 2026-07-23 03:44:02 | administrator    |
| 17 | Nx_ee40fd7d8812 | Nx_ee40fd7d8812 | [email protected]  | 2026-07-23 06:05:00 | administrator    |
| 14 | Nx_f340a3d389e4 | Nx_f340a3d389e4 | [email protected]  | 2026-07-23 00:18:35 | administrator    |
| 8  | upgrades        | upgrades        | [email protected]      | 2026-07-21 14:59:21 | administrator    |
| 5  | wpadmin0du      | wpadmin0du      | [email protected] | 2026-07-20 10:32:45 | administrator    |
| 7  | wpadmin3Su      | wpadmin3Su      | [email protected] | 2026-07-21 07:33:24 | administrator    |
| 6  | wpadminVUU      | wpadminVUU      | [email protected] | 2026-07-20 10:33:45 | administrator    |
+----+-----------------+-----------------+-----------------------------+---------------------+------------------+

WPscan output:

 | [!] 2 vulnerabilities identified:
 |
 | [!] Title: WP < 7.0.2 - Facilitated SQLi
 |     Fixed in: 7.0.2
 |     References:
 |      - https://wpscan.com/vulnerability/82a6c423-547b-4910-aea5-044070b08949
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60137
 |      - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
 |      - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
 |
 | [!] Title: WordPress < 7.0.2 - REST API batch-route confusion and SQLi to RCE
 |     Fixed in: 7.0.2
 |     References:
 |      - https://wpscan.com/vulnerability/73310d64-e790-4a78-ab0a-12995b762dba
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63030
 |      - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
 |      - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q

and the IMHO worst part:

the original database (mysql) dissappeared and 2 new ones where created.

my question now:
HOW could those databases been created ?

 

[Richard G]

HOW could those databases been created ?

Check if it's the same database user. If yes then they could have logged in via the original database username and pass via phpmyadmin and probably create new databases this way.
If I see the other things which happened, maybe they managed to get the accountname/pass too.

 

[Ohm J]

It's normally, one compromise site, user-home dir gonna fully compromise too.

 

[Richard G]

user-home dir gonna fully compromise too.

Yes but question was how databases got created. Compromise homedir does not give yet access to create new databases. Unless same dbuser/pass is used. If not same databaseuser/pass then complete account is compromised.

 

[sysdev]

If an attacker can write anything to disk, the complete user account is compromised. So, that's bad, but one user.

As said, adding databases isn't something users can do with only harvested mysql user accounts unless you have set up some very bad grants, but then you wouldn't ask about it, right?
The worst thing is the immutable .htaccess. Does lsattr really have the +i attr set? Well, you need to be root for that. So check this carefully, if done after 17th... wel, I hate to say it.... got backups?