WordPress Flaw: EKD Survivor Network 'BeNe' Hacked

Step by step
How the attack unfolded
Click a phase for details – or let the animation play through.
PHASE 1/6 · Initial Access

Attackers exploited the chained WordPress core vulnerability "wp2shell" to gain access to the BeNe platform without authentication.

T1190 – Exploit Public-Facing Application
  • CVE-2026-60137 (CVSS 9.1): SQL injection via the author__not_in parameter of the WP_Query class
  • CVE-2026-63030 (CVSS 7.5): unauthenticated REST API endpoint /wp-json/batch/v1
  • Affected: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1
  • No login, no credentials and no plugin required – exploitable anonymously and remotely
PHASE 2/6 · Execution

By chaining both vulnerabilities, the attackers executed arbitrary code on the web server (Remote Code Execution).

T1059 – Command and Scripting Interpreter
  • Combining both flaws enables full RCE with no preconditions
  • Proof-of-concept exploits publicly available from 19/20 July 2026
  • Automated bots attacked unpatched installations at scale
  • Over 500 million WordPress installations potentially affected worldwide
PHASE 3/6 · Privilege Escalation

The attackers created unauthorized administrator accounts to gain full control over the platform.

T1136.001 – Create Account: Local Account
  • Creation of admin accounts following the pattern wpsvc_[Hash]@wordpress-svc.internal
  • EKD confirmed the accounts and removed them afterwards
  • Access granted the attackers full administrative privileges
PHASE 4/6 · Persistence

Through malicious plugins and manipulated core files, the attackers ensured persistent access.

T1505.003 – Server Software Component: Web Shell T1546 – Event Triggered Execution
  • Installation of malicious plugins such as "Database Repair Assistant" and wp2s-[Hash]
  • Malicious code injected into .htaccess and index.php
  • Code automatically regenerated itself after updates
PHASE 5/6 · Exfiltration

The attackers presumably copied large parts of the database containing highly sensitive victim data.

T1005 – Data from Local System T1041 – Exfiltration Over C2 Channel
  • Data likely exfiltrated on a large scale
  • Affected: encrypted passwords, encrypted forum posts and private messages
  • Content about sexual violence and health consequences of victims
  • Compromise presumably between 17 and 21 July 2026
PHASE 6/6 · Impact

The data breach causes a massive loss of control for victims and looming phishing attacks.

T1657 – Financial Theft T1598 – Phishing for Information
  • BSI explicitly warns of subsequent phishing attacks against users
  • Decrypting the passwords could make private content readable
  • EKD took BeNe offline only on 21 July – too late
  • Victim representative Detlev Zander speaks of renewed massive loss of control
Short & clear answers
Frequently asked questions about this incident
Is my WordPress website affected by the wp2shell vulnerability?
Affected versions are WordPress 6.9.0 through 6.9.4 as well as 7.0.0 and 7.0.1. Check your version in the backend under "Dashboard → Updates" or enter your URL at https://wp2shell.com/. Not affected are version 6.8.5 and earlier as well as the patched versions 6.9.5, 6.8.6 and 7.0.2.
What do I need to do right now?
Update WordPress immediately to version 7.0.2 or 6.9.5 – this is the most important step. Then check whether your installation has already been compromised by looking for unknown admin accounts, suspicious plugins and modified files such as index.php and .htaccess. Do not rely solely on the automatic security update.
How can I tell if my site has already been hacked?
Under "Users → All Users" look for unknown admin accounts, especially those matching the pattern wpsvc_[Hash]@wordpress-svc.internal. Check your plugins for newly installed or unknown additions such as "Database Repair Assistant" or wp2s-[Hash]. It is also suspicious if the files index.php or .htaccess regenerate themselves; additionally you can run the "Compromise Scanner for wp2shell" plugin.
What makes this vulnerability so dangerous?
wp2shell consists of two chained flaws in the WordPress core (CVE-2026-60137 and CVE-2026-63030) that together enable Remote Code Execution. An unauthenticated attacker can run arbitrary code remotely – without credentials and without any plugin being installed. Because the exploit is easily automated, automated bots began attacking unpatched installations at scale shortly after disclosure.
Do I have to report the incident if data was leaked?
If personal data is affected, the reporting obligation under Article 33 GDPR to the competent data protection authority applies. The BSI also explicitly warns of subsequent phishing attacks against affected users, so notifying those affected is advisable. To assess this, also review your server logs from 17 July 2026 onward for unusual access.
More security news
You might also be interested in
Critical Elementor Pro Flaw: Attackers Can Fully Take Over WordPress Sites
A file upload bug in Elementor Pro up to 4.2.1 allows RCE without login. Version 4.2.2 fixes the flaw – update now!
Pods Plugin: Critical Flaw Enables Admin Takeover, No Login
A critical flaw in the WordPress plugin Pods lets attackers overwrite admin passwords without login. Over 100,000 sites are affected.
miniOrange SAML SSO: Critical Bypass Turns Attackers Into Admins
Two critical auth bypasses in the miniOrange SAML SSO plugin allow forged SAML assertions—up to full WordPress admin access.