wp2shell - PHP File Written to WordPress Content Directory
Detects a PHP file being written into a WordPress content directory that has no legitimate reason to hold executable code. The wp2shell chain against CVE-2026-63030 and CVE-2026-60137 stages its payload through wp-content/uploads/ and wp-content/upgrade/ before it lands as a plugin under wp-content/plugins/wp2shell_/, so both the staging directories and the campaign's plugin directory shape are matched. uploads/ is the durable half: WordPress serves user media from it and nothing there should ever be a .php file, which makes a PHP write there a strong webshell indicator independent of this campaign.
YARA-L
