Security researchers have shown that the critical wp2shell WordPress flaw doesn't have to stop at a web shell — it can be chained all the way to full Linux root, without writing a single file to disk. More striking, they assembled the entire chain with an AI coding agent in under an hour.
The post-exploitation chain, called wp2root, comes from research collective Calif.io and picks up exactly where wp2shell leaves off. wp2shell is the pre-auth RCE that Searchlight Cyber's Assetnote team disclosed on July 17 after discovering it with OpenAI's GPT-5.6 Sol, chaining two WordPress Core bugs (CVE-2026-63030 and CVE-2026-60137) into unauthenticated code execution across an install base of more than 500 million sites.
But wp2shell only drops an attacker into PHP as the low-privileged web user. On a hardened host, that interpreter is boxed in: disable_functions strips out system() and exec() (the calls a normal web shell relies on), and the filesystem may be mounted read-only. wp2root breaks out of that box.
It abuses a use-after-free bug in PHP's legacy Serializable code — a flaw that has sat unfixed for 21 years — to read arbitrary process memory, rebuild a return-oriented programming (ROP) chain from the live binary, and run native code. No disabled function is ever called, and nothing touches the disk. From there, it triggers Copy Fail (CVE-2026-31431), the April 2026 Linux kernel flaw that uses the AF_ALG crypto interface plus splice() to overwrite the page-cache copy of setuid-root /usr/bin/su, returning a root shell.
The stealth is the point. Because Copy Fail never alters the file on disk, integrity monitors like AIDE and Tripwire see nothing, and the bug affects nearly every Linux kernel built since 2017. Every stage lives in memory.
The researchers' larger message is about AI. They say Codex handled the weaponization that would once cost a skilled operator weeks — but the direction still came from humans who knew what was possible. "You can outsource the hacking, but not the understanding," they wrote.
Defenders should patch WordPress to 6.9.5 or 7.0.2 — wp2shell is already in CISA's Known Exploited Vulnerabilities catalog and under active attack — and apply kernel updates for CVE-2026-31431. On their own, disable_functions and read-only filesystems are not the containment that many admins assume.