{"id":15687,"date":"2026-08-07T17:51:30","date_gmt":"2026-08-07T14:51:30","guid":{"rendered":"https:\/\/www.inetmar.com\/blog\/?p=15687"},"modified":"2026-08-07T17:52:36","modified_gmt":"2026-08-07T14:52:36","slug":"wp2shell-cve-2026-63030","status":"publish","type":"post","link":"https:\/\/www.inetmar.com\/blog\/wp2shell-cve-2026-63030\/","title":{"rendered":"wp2shell (CVE-2026-63030): WordPress&#8217;i Sarsan Kritik RCE Zafiyeti ve Korunma Yollar\u0131!"},"content":{"rendered":"<p>WordPress ekosisteminde Temmuz 2026&#8217;da ortaya \u00e7\u0131kan <strong>wp2shell<\/strong>, internet \u00fczerindeki milyonlarca WordPress sitesini ilgilendiren kritik bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 olarak g\u00fcndeme geldi.<\/p>\n<p>A\u00e7\u0131\u011f\u0131n en \u00f6nemli \u00f6zelli\u011fi, belirli WordPress s\u00fcr\u00fcmlerinde sald\u0131rganlar\u0131n <strong>herhangi bir kullan\u0131c\u0131 hesab\u0131na ihtiya\u00e7 duymadan uzaktan kod \u00e7al\u0131\u015ft\u0131rabilmesine (RCE)<\/strong> kadar ilerleyebilen bir sald\u0131r\u0131 zincirinin olu\u015fturulabilmesi.<\/p>\n<p>\u00dcstelik s\u00f6z konusu a\u00e7\u0131k \u00fc\u00e7\u00fcnc\u00fc parti bir eklentiden veya temadan kaynaklanm\u0131yor. Do\u011frudan <strong>WordPress Core<\/strong> i\u00e7erisinde yer alan iki farkl\u0131 g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131n birlikte kullan\u0131lmas\u0131ndan olu\u015fuyor.<\/p>\n<p>Bu nedenle WordPress kullanan t\u00fcm site sahiplerinin s\u00fcr\u00fcmlerini kontrol etmesi ve gerekli g\u00fcncellemeleri vakit kaybetmeden yapmas\u0131 \u00f6nem ta\u015f\u0131yor.<\/p>\n<h2>wp2shell Nedir?<\/h2>\n<p>wp2shell, iki farkl\u0131 WordPress Core g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131n birlikte kullan\u0131labildi\u011fi bir sald\u0131r\u0131 zincirini ifade ediyor:<\/p>\n<ul>\n<li><strong>CVE-2026-63030:<\/strong> WordPress REST API i\u00e7erisindeki batch endpoint ile ilgili bir route confusion g\u00fcvenlik a\u00e7\u0131\u011f\u0131<\/li>\n<li><strong>CVE-2026-60137:<\/strong> <code>WP_Query<\/code> i\u00e7erisindeki <code>author__not_in<\/code> parametresini etkileyen SQL Injection a\u00e7\u0131\u011f\u0131<\/li>\n<\/ul>\n<p>Bu a\u00e7\u0131klar\u0131n birlikte kullan\u0131lmas\u0131, sald\u0131rganlar\u0131n herhangi bir kullan\u0131c\u0131 hesab\u0131na sahip olmadan WordPress sitelerine y\u00f6nelik sald\u0131r\u0131lar ger\u00e7ekle\u015ftirmesine ve sald\u0131r\u0131y\u0131 daha ileri ta\u015f\u0131yarak uzaktan kod \u00e7al\u0131\u015ft\u0131rmas\u0131na olanak sa\u011flayabiliyor.<\/p>\n<p>Bu nedenle wp2shell, yaln\u0131zca bir WordPress eklentisinin g\u00fcncellenmesiyle \u00e7\u00f6z\u00fclebilecek s\u0131radan bir g\u00fcvenlik problemi de\u011fil, <strong>WordPress Core seviyesinde ele al\u0131nmas\u0131 gereken kritik bir g\u00fcvenlik sorunu<\/strong>.<\/p>\n<h2>Sald\u0131r\u0131 Nas\u0131l Ger\u00e7ekle\u015febiliyor?<\/h2>\n<p>Sald\u0131r\u0131n\u0131n teknik ayr\u0131nt\u0131lar\u0131na girmeden genel olarak s\u00fcre\u00e7 \u015fu \u015fekilde ilerliyor:<\/p>\n<ol>\n<li>Sald\u0131rgan WordPress&#8217;in REST API&#8217;sine \u00f6zel haz\u0131rlanm\u0131\u015f bir istek g\u00f6nderiyor.<\/li>\n<li>REST API&#8217;deki g\u00fcvenlik a\u00e7\u0131\u011f\u0131ndan yararlan\u0131l\u0131yor.<\/li>\n<li>SQL Injection a\u00e7\u0131\u011f\u0131 kullan\u0131larak sistem \u00fczerinde yetki elde edilmeye \u00e7al\u0131\u015f\u0131l\u0131yor.<\/li>\n<li>Sald\u0131rgan y\u00f6netici seviyesine ula\u015f\u0131rsa WordPress \u00fczerinden zararl\u0131 kod veya arka kap\u0131 yerle\u015ftirebiliyor.<\/li>\n<li>Son a\u015famada site \u00fczerinde yetkisiz i\u015flemler ger\u00e7ekle\u015ftirebiliyor.<\/li>\n<\/ol>\n<p>Bu nedenle sald\u0131rgan\u0131n ilk a\u015famada WordPress kullan\u0131c\u0131 ad\u0131 veya \u015fifresini bilmesi gerekmeyebiliyor.<\/p>\n<h2>Hangi WordPress S\u00fcr\u00fcmleri Risk Alt\u0131nda?<\/h2>\n<p>WordPress taraf\u0131ndan yay\u0131nlanan g\u00fcvenlik g\u00fcncellemeleriyle sorun giderildi.<\/p>\n<p><strong>Riskli s\u00fcr\u00fcmler:<\/strong><\/p>\n<ul>\n<li>WordPress <strong>6.9.0 \u2013 6.9.4<\/strong><\/li>\n<li>WordPress <strong>7.0.0 \u2013 7.0.1<\/strong><\/li>\n<li>WordPress <strong>6.8.0 \u2013 6.8.5<\/strong> s\u00fcr\u00fcmleri ise ilgili SQL Injection a\u00e7\u0131\u011f\u0131ndan etkileniyor.<\/li>\n<\/ul>\n<p><strong>G\u00fcvenli s\u00fcr\u00fcmler:<\/strong><\/p>\n<ul>\n<li>WordPress <strong>6.9.5<\/strong><\/li>\n<li>WordPress <strong>7.0.2<\/strong><\/li>\n<li>WordPress <strong>6.8.6<\/strong><\/li>\n<\/ul>\n<p>WordPress, a\u00e7\u0131\u011f\u0131n ciddiyeti nedeniyle etkilenen s\u00fcr\u00fcmlerde otomatik g\u00fcvenlik g\u00fcncellemelerini de devreye ald\u0131.<\/p>\n<p>Ancak sitenizin otomatik olarak g\u00fcncellendi\u011fini varsaymak yerine <strong>WordPress s\u00fcr\u00fcm\u00fcn\u00fcz\u00fc kendiniz kontrol etmeniz<\/strong> \u00f6nemlidir.<\/p>\n<p>M\u00fcmk\u00fcnse eski bir s\u00fcr\u00fcmde kalmak yerine WordPress&#8217;in desteklenen en g\u00fcncel s\u00fcr\u00fcm\u00fcn\u00fc kullanman\u0131z \u00f6nerilir.<\/p>\n<h2>WordPress Sitenizi Nas\u0131l Koruyabilirsiniz?<\/h2>\n<h3>1. WordPress&#8217;i G\u00fcncelleyin<\/h3>\n<p>\u0130lk ve en \u00f6nemli ad\u0131m WordPress Core&#8217;u g\u00fcncellemektir.<\/p>\n<p>WordPress y\u00f6netim panelinizde:<\/p>\n<p><strong>Ba\u015flang\u0131\u00e7 \u2192 G\u00fcncellemeler<\/strong><\/p>\n<p>b\u00f6l\u00fcm\u00fcn\u00fc kontrol ederek sitenizin g\u00fcncel olup olmad\u0131\u011f\u0131n\u0131 g\u00f6rebilirsiniz.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-15689 size-full\" src=\"https:\/\/www.inetmar.com\/blog\/wp-content\/uploads\/2026\/08\/wordpress7.0.3.png\" alt=\"wp2shell\" width=\"1082\" height=\"425\" srcset=\"https:\/\/www.inetmar.com\/blog\/wp-content\/uploads\/2026\/08\/wordpress7.0.3.png 1082w, https:\/\/www.inetmar.com\/blog\/wp-content\/uploads\/2026\/08\/wordpress7.0.3-300x118.png 300w, https:\/\/www.inetmar.com\/blog\/wp-content\/uploads\/2026\/08\/wordpress7.0.3-1024x402.png 1024w, https:\/\/www.inetmar.com\/blog\/wp-content\/uploads\/2026\/08\/wordpress7.0.3-768x302.png 768w\" sizes=\"auto, (max-width: 1082px) 100vw, 1082px\" \/><\/p>\n<h3>2. Eklenti ve Temalar\u0131n\u0131z\u0131 G\u00fcncel Tutun<\/h3>\n<p>WordPress Core kadar eklenti ve temalar\u0131n da g\u00fcncel olmas\u0131 \u00f6nemlidir. Kullanmad\u0131\u011f\u0131n\u0131z veya uzun s\u00fcredir g\u00fcncellenmeyen eklentileri ve temalar\u0131 kald\u0131rman\u0131z sitenizin genel sald\u0131r\u0131 y\u00fczeyini azaltacakt\u0131r.<\/p>\n<h3>3. Y\u00f6netici Hesaplar\u0131n\u0131z\u0131 Kontrol Edin<\/h3>\n<p>WordPress panelinizde <strong>Kullan\u0131c\u0131lar<\/strong> b\u00f6l\u00fcm\u00fcn\u00fc kontrol edin. Tan\u0131mad\u0131\u011f\u0131n\u0131z bir y\u00f6netici hesab\u0131 g\u00f6r\u00fcrseniz hesab\u0131 hemen silin \u00e7\u00fcnk\u00fc bilinmeyen bir y\u00f6netici hesab\u0131, sitenizin daha \u00f6nce ele ge\u00e7irilmi\u015f oldu\u011funa dair \u00f6nemli bir i\u015faret olabilir.<\/p>\n<h3>4. \u015e\u00fcpheli Dosya ve De\u011fi\u015fikliklere Dikkat Edin<\/h3>\n<p>Sitenizde aniden ortaya \u00e7\u0131kan:<\/p>\n<ul>\n<li>Tan\u0131mad\u0131\u011f\u0131n\u0131z PHP dosyalar\u0131<\/li>\n<li>Bilginiz d\u0131\u015f\u0131nda eklenen eklentiler<\/li>\n<li>Beklenmeyen y\u00f6nlendirmeler<\/li>\n<li>Spam i\u00e7erikler<\/li>\n<li>De\u011fi\u015ftirilmi\u015f tema veya site dosyalar\u0131<\/li>\n<\/ul>\n<p>gibi durumlar fark ederseniz sitenizin g\u00fcvenlik kontrol\u00fcnden ge\u00e7irilmesi gerekir.<\/p>\n<h3>5. Parolalar\u0131n\u0131z\u0131 G\u00fc\u00e7l\u00fc Tutun<\/h3>\n<p>WordPress y\u00f6netici hesab\u0131n\u0131zda g\u00fc\u00e7l\u00fc ve benzersiz bir parola kullan\u0131n. Ayn\u0131 parolay\u0131 WordPress, cPanel, FTP veya ba\u015fka servislerde kullanmay\u0131n. M\u00fcmk\u00fcn olan durumlarda <strong>iki a\u015famal\u0131 do\u011frulamay\u0131 (2FA)<\/strong> etkinle\u015ftirmeniz de hesab\u0131n\u0131z\u0131n g\u00fcvenli\u011fini \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131racakt\u0131r.<\/p>\n<h2>Siteniz Daha \u00d6nce Sald\u0131r\u0131ya U\u011fram\u0131\u015f Olabilir mi?<\/h2>\n<p>Burada \u00f6nemli bir noktaya dikkat etmek gerekiyor:<\/p>\n<p><strong>WordPress&#8217;i bug\u00fcn g\u00fcncellemek, sitenizin daha \u00f6nce sald\u0131r\u0131ya u\u011framad\u0131\u011f\u0131n\u0131 garanti etmez.<\/strong><\/p>\n<p>E\u011fer siteniz uzun s\u00fcre boyunca savunmas\u0131z bir WordPress s\u00fcr\u00fcm\u00fc kulland\u0131ysa, sald\u0131rganlar g\u00fcncellemeden \u00f6nce sisteme eri\u015fmi\u015f olabilir.<\/p>\n<p>Bu nedenle g\u00fcncelleme sonras\u0131nda da sitenizde;<\/p>\n<ul>\n<li>Bilinmeyen y\u00f6netici hesaplar\u0131,<\/li>\n<li>\u015e\u00fcpheli eklentiler,<\/li>\n<li>Tan\u0131mad\u0131\u011f\u0131n\u0131z dosyalar,<\/li>\n<li>Beklenmeyen y\u00f6nlendirmeler,<\/li>\n<li>Spam i\u00e7erikler,<\/li>\n<li>Anormal site davran\u0131\u015flar\u0131<\/li>\n<\/ul>\n<p>olup olmad\u0131\u011f\u0131n\u0131 kontrol etmek \u00f6nemlidir.<\/p>\n<p>\u015e\u00fcpheli bir durum fark ederseniz sitenizi temiz bir yede\u011fe d\u00f6nd\u00fcrmek veya profesyonel bir g\u00fcvenlik kontrol\u00fc yapt\u0131rmak gerekebilir.<\/p>\n<h2>WordPress Hosting Se\u00e7iminiz de G\u00fcvenlik Kadar \u00d6nemli<\/h2>\n<p>WordPress g\u00fcvenli\u011fi yaln\u0131zca sitenin kendi ayarlar\u0131ndan ibaret de\u011fildir. Sitenin bar\u0131nd\u0131r\u0131ld\u0131\u011f\u0131 sunucunun g\u00fcvenlik altyap\u0131s\u0131 da olduk\u00e7a \u00f6nemlidir. <strong>20 y\u0131l\u0131 a\u015fk\u0131n sekt\u00f6r tecr\u00fcbesine sahip \u0130netmar ailesi olarak<\/strong> WordPress siteleriniz i\u00e7in performans ve g\u00fcvenli\u011fi birlikte hedefleyen hosting altyap\u0131lar\u0131 sunuyoruz. \u00d6zellikle WordPress kullan\u0131c\u0131lar\u0131 i\u00e7in haz\u0131rlad\u0131\u011f\u0131m\u0131z <strong>Imunify360 destekli <a href=\"https:\/\/www.inetmar.com\/hosting\/wordpress-hosting\/\" target=\"_blank\" rel=\"noopener\">WordPress Hosting<\/a><\/strong> hizmetlerimiz ile sitelerinizi yaln\u0131zca bar\u0131nd\u0131rmakla kalmay\u0131p, sunucu seviyesinde geli\u015fmi\u015f g\u00fcvenlik katmanlar\u0131ndan da yararlanman\u0131z\u0131 hedefliyoruz. WordPress siteniz i\u00e7in g\u00fcvenli ve profesyonel bir hosting altyap\u0131s\u0131 ar\u0131yorsan\u0131z<strong>\u00a0WordPress Hosting<\/strong> paketlerimizi tercih edebilirsiniz.<\/p>\n<p>wp2shell, WordPress Core seviyesinde ortaya \u00e7\u0131kan ve belirli s\u00fcr\u00fcmlerde sald\u0131rganlar\u0131n kimlik do\u011frulamas\u0131 olmadan sistemlere eri\u015fmesine kadar ilerleyebilen kritik bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131d\u0131r.<\/p>\n<p>Bu nedenle WordPress kullan\u0131c\u0131lar\u0131n\u0131n:<\/p>\n<p><strong>G\u00fcncellemesi \u2192 Kontrol etmesi \u2192 G\u00fcvenli bir hosting altyap\u0131s\u0131 kullanmas\u0131<\/strong><\/p>\n<p>b\u00fcy\u00fck \u00f6nem ta\u015f\u0131yor.<\/p>\n<p>\u00d6zellikle WordPress siteniz eski bir s\u00fcr\u00fcm kullan\u0131yorsa g\u00fcncellemeyi ertelemeyin.<\/p>\n<p>Unutmay\u0131n:<\/p>\n<blockquote><p><strong>G\u00fcncel WordPress + g\u00fcncel eklenti ve temalar + g\u00fc\u00e7l\u00fc parolalar + g\u00fcvenli hosting altyap\u0131s\u0131 = daha g\u00fcvenli bir web sitesi<\/strong><\/p><\/blockquote>\n<p>Sitenizin g\u00fcvenli\u011fi konusunda herhangi bir \u015f\u00fcpheniz varsa profesyonel destek almaktan \u00e7ekinmeyin.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>WordPress ekosisteminde Temmuz 2026&#8217;da ortaya \u00e7\u0131kan wp2shell, internet \u00fczerindeki milyonlarca WordPress sitesini ilgilendiren kritik bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 olarak g\u00fcndeme geldi. A\u00e7\u0131\u011f\u0131n en \u00f6nemli \u00f6zelli\u011fi, belirli WordPress s\u00fcr\u00fcmlerinde sald\u0131rganlar\u0131n herhangi bir kullan\u0131c\u0131 hesab\u0131na ihtiya\u00e7 duymadan uzaktan&#46;&#46;&#46;<\/p>\n","protected":false},"author":2,"featured_media":15690,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[52,18],"tags":[],"class_list":["post-15687","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guvenlik","category-wordpress"],"_links":{"self":[{"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/posts\/15687","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/comments?post=15687"}],"version-history":[{"count":3,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/posts\/15687\/revisions"}],"predecessor-version":[{"id":15692,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/posts\/15687\/revisions\/15692"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/media\/15690"}],"wp:attachment":[{"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/media?parent=15687"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/categories?post=15687"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/tags?post=15687"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}