regarding CVE-2026-63030 / CVE-2026-60137

shanti

shanti

Verified User
Joined
Apr 8, 2009
Messages
94
Location
Wien / Vienna - Austria
Hello,

I had a dissapointing moment lately where a customer's wordpress (7.0.1) had been hacked by the infamous webshell (circling around)

quick symptoms were:
  • email-bounces
  • at least private_html/.htaccess was set immuteable
  • several .htaccess-files planted everwhere over public_html
  • i have seen files created outside of public_html :-o
Code: 
~/domains/filefuns.php
(which gives me the creeps)
  • several new wp-users
Code: 
$ wp user list

+----+-----------------+-----------------+-----------------------------+---------------------+------------------+
| ID | user_login      | display_name    | user_email                  | user_registered     | roles            |
+----+-----------------+-----------------+-----------------------------+---------------------+------------------+
| 15 | Nx_2219b90b8401 | Nx_2219b90b8401 | [email protected]  | 2026-07-23 00:53:09 | administrator    |
| 18 | Nx_246c412408f3 | Nx_246c412408f3 | [email protected]  | 2026-07-23 06:19:34 | administrator    |
| 11 | Nx_2d86913dae7f | Nx_2d86913dae7f | [email protected]  | 2026-07-22 16:11:13 | administrator    |
| 19 | Nx_469a97b1c49a | Nx_469a97b1c49a | [email protected]  | 2026-07-23 10:11:52 | administrator    |
| 9  | Nx_5b27e4ed9005 | Nx_5b27e4ed9005 | [email protected]  | 2026-07-22 05:08:42 | administrator    |
| 12 | Nx_7da4145078db | Nx_7da4145078db | [email protected]  | 2026-07-22 20:21:52 | administrator    |
| 10 | Nx_d9376bb5188c | Nx_d9376bb5188c | [email protected]  | 2026-07-22 15:30:10 | administrator    |
| 13 | Nx_dc282526b447 | Nx_dc282526b447 | [email protected]  | 2026-07-22 23:33:14 | administrator    |
| 16 | Nx_e2d1e93367bc | Nx_e2d1e93367bc | [email protected]  | 2026-07-23 03:44:02 | administrator    |
| 17 | Nx_ee40fd7d8812 | Nx_ee40fd7d8812 | [email protected]  | 2026-07-23 06:05:00 | administrator    |
| 14 | Nx_f340a3d389e4 | Nx_f340a3d389e4 | [email protected]  | 2026-07-23 00:18:35 | administrator    |
| 8  | upgrades        | upgrades        | [email protected]      | 2026-07-21 14:59:21 | administrator    |
| 5  | wpadmin0du      | wpadmin0du      | [email protected] | 2026-07-20 10:32:45 | administrator    |
| 7  | wpadmin3Su      | wpadmin3Su      | [email protected] | 2026-07-21 07:33:24 | administrator    |
| 6  | wpadminVUU      | wpadminVUU      | [email protected] | 2026-07-20 10:33:45 | administrator    |
+----+-----------------+-----------------+-----------------------------+---------------------+------------------+

WPscan output:
Code: 
 | [!] 2 vulnerabilities identified:
 |
 | [!] Title: WP < 7.0.2 - Facilitated SQLi
 |     Fixed in: 7.0.2
 |     References:
 |      - https://wpscan.com/vulnerability/82a6c423-547b-4910-aea5-044070b08949
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60137
 |      - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
 |      - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
 |
 | [!] Title: WordPress < 7.0.2 - REST API batch-route confusion and SQLi to RCE
 |     Fixed in: 7.0.2
 |     References:
 |      - https://wpscan.com/vulnerability/73310d64-e790-4a78-ab0a-12995b762dba
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63030
 |      - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
 |      - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q

and the IMHO worst part:

the original database (mysql) dissappeared and 2 new ones where created.
1785070165838.png



my question now:
HOW could those databases been created ?
 
Last edited:
shanti said:
HOW could those databases been created ?
Click to expand...
Check if it's the same database user. If yes then they could have logged in via the original database username and pass via phpmyadmin and probably create new databases this way.
If I see the other things which happened, maybe they managed to get the accountname/pass too.
 
If an attacker can write anything to disk, the complete user account is compromised. So, that's bad, but one user.

As said, adding databases isn't something users can do with only harvested mysql user accounts unless you have set up some very bad grants, but then you wouldn't ask about it, right?
The worst thing is the immutable .htaccess. Does lsattr really have the +i attr set? Well, you need to be root for that. So check this carefully, if done after 17th... wel, I hate to say it.... got backups?
 
Richard G said:
Check if it's the same database user. If yes then they could have logged in via the original database username and pass via phpmyadmin and probably create new databases this way.
If I see the other things which happened, maybe they managed to get the accountname/pass too.
Click to expand...
it is not the originally datebaseuser .. and the original database vanished

webshell created 2 dbs with access like username=detabasename

i can't really figure out how a phpbased operation would manage to succeed in that way
shanti said:
Hello,

I had a dissapointing moment lately where a customer's wordpress (7.0.1) had been hacked by the infamous webshell (circling around)

quick symptoms were:
  • email-bounces
  • at least private_html/.htaccess was set immuteable
  • several .htaccess-files planted everwhere over public_html
  • i have seen files created outside of public_html :-o
Code: 
~/domains/filefuns.php
(which gives me the creeps)
  • several new wp-users
Code: 
$ wp user list

+----+-----------------+-----------------+-----------------------------+---------------------+------------------+
| ID | user_login      | display_name    | user_email                  | user_registered     | roles            |
+----+-----------------+-----------------+-----------------------------+---------------------+------------------+
| 15 | Nx_2219b90b8401 | Nx_2219b90b8401 | [email protected]  | 2026-07-23 00:53:09 | administrator    |
| 18 | Nx_246c412408f3 | Nx_246c412408f3 | [email protected]  | 2026-07-23 06:19:34 | administrator    |
| 11 | Nx_2d86913dae7f | Nx_2d86913dae7f | [email protected]  | 2026-07-22 16:11:13 | administrator    |
| 19 | Nx_469a97b1c49a | Nx_469a97b1c49a | [email protected]  | 2026-07-23 10:11:52 | administrator    |
| 9  | Nx_5b27e4ed9005 | Nx_5b27e4ed9005 | [email protected]  | 2026-07-22 05:08:42 | administrator    |
| 12 | Nx_7da4145078db | Nx_7da4145078db | [email protected]  | 2026-07-22 20:21:52 | administrator    |
| 10 | Nx_d9376bb5188c | Nx_d9376bb5188c | [email protected]  | 2026-07-22 15:30:10 | administrator    |
| 13 | Nx_dc282526b447 | Nx_dc282526b447 | [email protected]  | 2026-07-22 23:33:14 | administrator    |
| 16 | Nx_e2d1e93367bc | Nx_e2d1e93367bc | [email protected]  | 2026-07-23 03:44:02 | administrator    |
| 17 | Nx_ee40fd7d8812 | Nx_ee40fd7d8812 | [email protected]  | 2026-07-23 06:05:00 | administrator    |
| 14 | Nx_f340a3d389e4 | Nx_f340a3d389e4 | [email protected]  | 2026-07-23 00:18:35 | administrator    |
| 8  | upgrades        | upgrades        | [email protected]      | 2026-07-21 14:59:21 | administrator    |
| 5  | wpadmin0du      | wpadmin0du      | [email protected] | 2026-07-20 10:32:45 | administrator    |
| 7  | wpadmin3Su      | wpadmin3Su      | [email protected] | 2026-07-21 07:33:24 | administrator    |
| 6  | wpadminVUU      | wpadminVUU      | [email protected] | 2026-07-20 10:33:45 | administrator    |
+----+-----------------+-----------------+-----------------------------+---------------------+------------------+

WPscan output:
Code: 
 | [!] 2 vulnerabilities identified:
 |
 | [!] Title: WP < 7.0.2 - Facilitated SQLi
 |     Fixed in: 7.0.2
 |     References:
 |      - https://wpscan.com/vulnerability/82a6c423-547b-4910-aea5-044070b08949
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60137
 |      - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
 |      - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
 |
 | [!] Title: WordPress < 7.0.2 - REST API batch-route confusion and SQLi to RCE
 |     Fixed in: 7.0.2
 |     References:
 |      - https://wpscan.com/vulnerability/73310d64-e790-4a78-ab0a-12995b762dba
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63030
 |      - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
 |      - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q

and the IMHO worst part:

the original database (mysql) dissappeared and 2 new ones where created.
View attachment 9839


my question now:
HOW could those databases been created ?
Click to expand...

1st off: Thanks @ALL for your feedback

@Richard G as mentioned: we see completely new databases with new database-users. To me the mechanism used to do so is yet not clear to me , since the customer is unpriviledged

@sysdev : about GRANTS , we operate in DA-defaults as far as i can tell .. and YES, we have uncompromised backups of that site via installatron .. currently we operate this site as a static-html-site (and php disabled) for now until i can tell what really happened. The immuteable file was predicted to exists and was the only one immuted (+i definitly was set)

further info:
the system runs with 'hidepid=invisible' and any shell of the user is restricted to it $HOME ... as far as i can tell, this webshell-attack had a lot potential , but it didnt alter .ssh/authorized_key or installed any cronjob or timerjob or worse.. looks more like a incomplete unsophisticated script-kiddy-job AFAIKS ..

i dont want to suspect any 0day-exploit regarding DA or whatever .. but if creating db-users should not be(en) possible, what could/would a vector look like to have such results ?? i had the impression that this systemsetup i quite strict .. so HOW ? :-o

any clue on what to check ?
 
Last edited:
what happends when you enter in an ssh session or on the shell on the server the following:
mysql -u root

do you get this:
ERROR 1698 (28000): Access denied for user 'root'@'localhost'

Or do you see this:

Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 8
Server version: 12.3.2-MariaDB Debian Linux

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]>
 
Alex1441 said:
what happends when you enter in an ssh session or on the shell on the server the following:
mysql -u root
Click to expand...

Hi Alex, thanks for reply
in shell of affected user i get:
Code: 
$ mysql -u root
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)

further the user has no access to sudo-elevation (just FYI)
 
Check DirectAdmin access log. Someone may have hijacked the DA user's session and gained access to their panel (sessions used to be assigned to IP addresses, but that was changed some time ago for some unknown to me reason).
Show your kernel version, when was the last time you updated it?
There were at least two exploitable bugs in kernel (one of which was in the xfs filesystem) this month.
 
1) Check the folder / files creation, modification timstamps inside /var/lib/mysql/mhe_quyk1 , /var/lib/mysql/mhe_y2bm1
Compare it with DirectAdmin log for any hints.

2) Or, does your wp-config.php store DirectAdmin username, password (instead of db username, password) to access the db in the past.
 
if you want to know more, please hire real security expert guy to reviews the issued from the inside, we can only guest here
 
You must log in or register to reply here.
Back
Top