Skip to content
Product
Use it
Threat intelligence API
Free key, 70+ endpoints, OpenAPI. The product.
Get started
Pick your stack, make your first call.
Live feed
The console: incidents, filters, entities, search.
Recipes
Runnable examples for the free key.
Free feeds
RSS, ransomware feed, IOC blocklist, MISP — no key.
CLI & agents
tc from a terminal; agent keys with scoped budgets.
The data
Incident records
900 articles a day become ~70 scored incidents.
Dark web
First-party leak-site collection: victims, groups, markets.
Validated IOCs
Indicators with a false-positive gate; STIX, MISP, CSV.
Vulnerabilities
CVEs with EPSS, KEV and exploit status.
Entity graph
Actors, malware, CVEs, companies — pivotable.
For teams
For service providers
Per-client feeds, alerts and branded digests.
Use cases
How teams and builders use the corpus.
About ThreatCluster
What it is and how it is built.
Pricing
Docs
Reference
OpenAPI (Swagger)
Every endpoint, parameter and response model.
ReDoc
The same reference, long-form.
Examples on GitHub
curl, Python and Node quickstarts; daily spec snapshot.
Guides
Quickstart & plans
Key, scopes, budgets, tiers.
Integrations
Splunk, Sentinel, Elastic, agents and terminals, step by step
Export formats
STIX 2.1, MISP, CSV, text.
CLI setup
Install, log in, wire an agent.
No results found
Sign in
Get a free key
No results found
Product
Threat intelligence API
Get started
Live feed
Recipes
Free feeds
CLI & agents
The data
Incident records
Dark web
Validated IOCs
Vulnerabilities
Entity graph
For teams
For service providers
Use cases
About ThreatCluster
Docs
OpenAPI (Swagger)
ReDoc
Examples on GitHub
Quickstart & plans
Integrations
Export formats
CLI setup
Pricing
Contact
Get a free key
Sign in
Back
Wp2shell
Vulnerability
Threat entity extracted from intelligence sources
Oct 20: 0 mentions
Oct 21: 0 mentions
Oct 22: 1 mention
Oct 23: 0 mentions
Oct 24: 0 mentions
Oct 25: 0 mentions
Oct 26: 0 mentions
Oct 20
Oct 23
Oct 26
Entities
›
vulnerability
›
Wp2shell
Frequency
34
occurrences
First Seen
July 17, 2026
Last Seen
October 22, 2026
API
Overview
Recent Events
Profile
Profile
MITRE ATT&CK
1 / 2
Exploited By
Energetic Bear
Wp-shellstorm
BlackCat
Lockbit
Ryuk
Associated Malware
Cobalt Strike
Infostealer
Overlord RAT
WSO Web Shell
Tools Used
Docker
Google Dork Queries
PHP2Shell
Searchlight Cyber
Shodan
Snort
WSO
YARA
Related CVEs
CVE-2026-63030
CVE-2026-60137
CVE-2026-93485
CVE-2026-21858
CVE-2026-34926
CVE-2026-4815
CVE-2026-64638
CVE-2026-66804
MITRE Techniques
T1190 - Exploit Public-Facing Application
T1505.003 - Web Shell
T1041 - Exfiltration Over C2 Channel
T1021 - Remote Services
T1059 - Command and Scripting Interpreter
Campaigns
CyberXero
FortiBleed
Affected Platforms
WordPress
PHP
Active Directory
Apache Struts
Ec-cube
ESXi
Regions
Australia
Canada
China
Finland
France
Sectors Affected
Energy
Manufacturing
Utilities
-
REC
Recon
No techniques detected
-
RD
Resource Dev
No techniques detected
1
IA
Initial Access
T1190 - Exploit Public-Facing Application
1
EX
Execution
T1059 - Command and Scripting Interpreter
1
PE
Persistence
T1505.003 - Web Shell
-
PE
Priv Esc
No techniques detected
-
DE
Defense Evasion
No techniques detected
-
CA
Cred Access
No techniques detected
-
DI
Discovery
No techniques detected
1
LM
Lateral Mov
T1021 - Remote Services
-
CO
Collection
No techniques detected
-
C2
C2
No techniques detected
1
EX
Exfil
T1041 - Exfiltration Over C2 Channel
-
IM
Impact
No techniques detected
5
techniques detected across
5
tactics
Related Clusters (7)
CyberXero Campaign Targets Ukrainian Records Using AI Tools
Oct 12
·
5 sources
79
Critical wp2shell Vulnerability Enables Unauthenticated RCE in WordPress
Jul 20
·
46 sources
73
SQL Injection and RCE Vulnerabilities in WordPress Exploited
Oct 13
·
3 sources
73
GPT-5.6 Discovers $500k WordPress RCE Vulnerability for $25
Jul 20
·
2 sources
72
Surge in Cyber Incidents Targeting Japanese Web Systems
Oct 11
·
0 sources
70
Critical RCE Vulnerability in BeyondTrust Software Requires Immediate Patching
Feb 9
·
860 sources
67
WordPress Comment2Shell Vulnerability Allows RCE via Anonymous Comments
Sep 22
·
2 sources
65
Prev
1 / 2
Next
Related Articles (34)
Attacks begin on global websites as Canada's cyber centre issues alerts
Insurancebusinessmag
·
4d ago
Ultimate
Sploitus
·
Oct 12
CyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records
Securityaffairs
·
Oct 12
Web Incidents2026
security.macnica.co.jp
·
Oct 8
Russian
Gbhackers
·
Oct 7
PAYLOAD ransomware hijacks Windows Group Policy in encryption
Cyberinsider
·
Sep 22
WordPress Comment2Shell Flaw Turns Comments Into RCE
Cyberkendra
·
Sep 22
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
Thehackernews
·
Sep 22
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
Thehackernews
·
Sep 18
Wp2shell
www.vulncheck.com
·
Jul 21
Wp2shell Pre Authentication Rce In Word Press Core
slcyber.io
·
Jul 21
Hackers Are Exploiting Recently Patched WordPress Bugs, Putting Millions of Websites at Risk
Rss.Slashdot
·
Jul 21
Attackers pummel critical WordPress vuln to create all sorts of mischief
Theregister
·
Jul 20
wp2shell: WordPress RCE (CVE-2026-63030)
Secra.Es
·
Jul 20
WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)
Isc.Sans.Edu
·
Jul 20
Hackers Exploit Patched WordPress Bugs - Millions of Sites Still at Risk
Gadgetreview
·
Jul 20
Hackers Target Millions of WordPress Sites, Experts Urge Immediate Updates
Mezha
·
Jul 20
Hackers are exploiting recently patched WordPress bugs, putting millions of websites at risk
Techcrunch
·
Jul 20
Critical wp2shell RCE Vulnerability
Cybersecuritynews
·
Jul 20
GPT-5.6 Sol Ultra Found Wp2shell RCE That Could Be Worth $500,000 for About $25
Cybersecuritynews
·
Jul 20
wp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Core
Tenable
·
Jul 20
GPT-5.6 Sol Ultra Discovers WordPress Pre
Gbhackers
·
Jul 20
Patch now: WordPress REST API bug allows remote code execution
Csoonline
·
Jul 20
Hackers exploit critical WordPress vulnerability to run malicious code
Cybernews
·
Jul 20
Wp2shell: The Unauthenticated WordPress Exploit That Needs No Login, No Plugins, Just a ...
Technadu
·
Jul 20
Critical wp2shell CVEs Enable Unauthenticated Remote Code Execution in WordPress ...
Rescana
·
Jul 20
"Wp2shell: Critical WordPress Gap Allows Code Insertion via API
www.heise.de
·
Jul 19
Wp2shell Pre Authentication Rce In Wordpress Core
slcyber.io
·
Jul 19
WordPress "wp2shell" RCE Vulnerabilities Draw Active Exploitation as Public Exploits Circulate
Techechelon
·
Jul 19
Cloudflare Has Urgently Deployed Cloud-Based WAF Rules to Block Attacks Targeting the High-Risk Remote Code Execution Vulnerability in WordPress.
unsafe.sh
·
Jul 18
Critical wp2shell vulnerability enables unauthenticated RCE in WordPress core
Feeds.4Sysops
·
Jul 18
New wp2shell RCE Vulnerability Hits Millions of WordPress Sites, Emergency Patch Released
Cybersecuritynews
·
Jul 18
wp2shell: Pre Authentication RCE in WordPress Core
Slcyber
·
Jul 17
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
Thehackernews
·
Jul 17
Prev
1 / 7
Next
Related Entities
Energetic Bear
Wp-shellstorm
Sql Injection
Zero-day Exploit
Data Breach
Remote Code Execution
Ransomware
Web Shell
CyberXero
FortiBleed
Centre De Services Scolaire Marie-Victorin
Nintendo
