WordPress is one of the most widely used content management systems worldwide, and consequently, the attack surface is large when a critical vulnerability appears in the core of the system. This is exactly what happened with wp2shell, a combination of two vulnerabilities that together create a unauthorized code execution enable. Security researchers are already confirming active attacks on the internet, so time is of the essence.
What's behind wp2shell
wp2shell refers to the combination of two vulnerabilities in the WordPress core that are much more dangerous together than each one is on its own. CVE-2026-63030 is in the REST API and causes confusion between different batch routes, allowing multiple requests to be evaluated differently in a single call than actually intended by the system, The Hacker News describes the mechanism in detail in its own analysis. CVE-2026-60137 is a SQL Injection in the parameter author__not_in of the WP_Query class, which is used in the background with the MySQL-database communicates and is supposed to actually filter out only authors there. Combined, both loopholes allow an anonymous attacker Remote Code Execution, So, executing your own code on a foreign server, regardless of whether additional security plugins are installed.
Installations from versions 6.8.0 to 6.8.5 are affected by the SQL injection alone, and versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 are affected by the complete, much more dangerous chain of both vulnerabilities. Those running versions older than 6.8 are not affected, which, given outdated installations and their own risks, is rarely of any real comfort. The two vulnerabilities were discovered and reported independently: the REST API vulnerability by Assetnote and Searchlight Cyber, and the SQL injection by the research team TF1T, dtro, and haongo. The WordPress core team responded with a Emergency Update for all three affected version branches. The details about the official patch have WordPress published in a separate post, including a technical description of both vulnerabilities.
Why the attack is so dangerous
The combination of both loopholes works without registration and without a single installed Plugin, A standard WordPress is already enough of a target. This is precisely what distinguishes wp2shell from most security vulnerabilities of recent years, which usually found their way into the system via vulnerable extensions or themes and could therefore be more easily contained. ExpertInsights calls the vulnerability the first critical, unauthenticated remote code execution in the WordPress core in nearly a decade. Those who underestimate the scope risk full compromise of their server, including the database, customer data, and in the worst case, also linked systems such as newsletter tools or payment providers.
As early as July 17, 2026, the security service provider Wordfence registered the first test requests to the REST API, followed by the first real injection attempt a few minutes later. Shortly thereafter, a public repository appeared on GitHub Proof of Concept which made the complete attack chain understandable step by step, thereby also making it easier for less experienced attackers to get started. The Federal Office for Information Security subsequently classified the situation as Alert Level Orange one, how heise in its ongoing reporting. Also SecurityWeek confirmed active attacks on the web and classified the campaign as one of the more serious WordPress incidents of the current year.
What operators must do now
The most important step is simple, even though it's often postponed in daily business. Check which WordPress version your site is currently running on and update immediately to 6.8.6, 6.9.5, or 7.0.2, depending on which version branch you are using. Because the severity of the vulnerability allows no waiting time, the core team has enforced automatic background updates for affected versions, so many sites are already running on a patched version, provided the host has not disabled this function for their own reasons. Nevertheless, check the version number yourself in the backend, because especially with managed hosting packages and specially configured servers, their own update rules sometimes apply.
- Check the WordPress version in the dashboard under „Updates“ and manually update to 6.8.6, 6.9.5, or 7.0.2 if necessary, even for multiple installations.
- Review server and access logs from the past few days for unusual requests to the REST API, especially around July 17th.
- Create a fresh database backup before making major changes so you can cleanly revert in case of emergencies.
- Enable automatic updates in hosting so that future emergency patches are applied without delay.
- In case of suspected compromise, consistently reset passwords, salts, and API keys, and check user accounts.
WordPress maintenance as an ongoing task
wp2shell shows how quickly a solid website can become an open barn door if updates are neglected or responsibilities are unclear between the agency, host, and client. The WordPress core in particular was previously considered exemplary in its maintenance, making a vulnerability of this magnitude all the more deserving of attention. Anyone who wants their CMS (Content Management System) If maintenance is not performed regularly, you eventually rely on luck, and luck is not a concept of security, as is well known. You may already know deadlines of this kind from Accessibility Strengthening Act, every week counted there too, and just like back then, our WordPress Agency Düsseldorf also when it comes to the technical security and ongoing maintenance of your website.
- Anchor regular updates for WordPress, themes, and plugins firmly in your editorial calendar, rather than leaving them to chance.
- Implement a web application firewall and login protection to intercept attack attempts early
- Set up monitoring and uptime alerts so that anomalies are noticed immediately, not weeks later.
- Use a staging environment to thoroughly test updates before going live, instead of experimenting live on your own website.
FAQs about wp2shell
What is wp2shell?
wp2shell is the name for a combination of two core WordPress vulnerabilities, CVE-2026-63030 and CVE-2026-60137. Together, they allow an unauthenticated attacker to execute arbitrary code on a remote server, without needing a valid account, plugin, or user interaction. The name wp2shell alludes to the fact that the end of the attack chain effectively leads to server takeover.
Which WordPress versions are affected?
The SQL injection affects versions 6.8.0 to 6.8.5, 6.9.0 to 6.9.4, and 7.0.0 to 7.0.1. The complete attack chain with code execution affects versions 6.9.0 and later up to and including 7.0.1. Versions older than 6.8 are not affected by wp2shell.
Do I have to update immediately?
Yes. As public exploit code is already circulating and active attacks have been confirmed, you should update immediately to 6.8.6, 6.9.5, or 7.0.2 and not wait for the next regular maintenance window.
Is the automatic update sufficient?
Yes, in most cases, because the core team has enabled forced background updates due to the severity of the gap. Nevertheless, manually check the version number in the dashboard in case automatic updates have been disabled for you or your host uses its own update rules.
How do I recognize a successful attack?
Watch out for unknown administrator accounts, modified files in the core directory, and unusual entries in the server logs around July 17, 2026. If in doubt, a look at your host's logs or a quick security audit by an experienced service provider can help, especially if you feel technically insecure.
