WordPress Security Alert: What the July 2026 wp2shell Vulnerability Means for Your Site

← Back to Blog

On July 17, 2026, WordPress pushed an emergency patch for a bug researchers nicknamed wp2shell: two flaws that, chained together, let an attacker take over a WordPress site with no username, no password, and no warning. Four days later, the US government's CISA confirmed it was already being used in real attacks, not a theoretical risk. If a site you run, or manage for a client, was on WordPress 6.8 through 7.0.1 any time in the weeks after, this is worth reading before you close this tab.

What actually happened with wp2shell?

WordPress 7.0.2 fixed two bugs that, on their own, weren't catastrophic. Chained together, they were. One was a logic flaw in how the REST API's batch endpoint validates and executes requests (CVE-2026-63030). The other was a SQL injection sitting in core (CVE-2026-60137). Combined, an attacker with no account on your site at all could get code running on your server, no login screen, no password guessing, nothing. Researchers called the chain wp2shell because that's exactly what it hands an attacker: a shell on your server.

Was my site actually at risk, or is this being overblown?

It wasn't theoretical. Four days after the patch shipped, CISA, the US agency that tracks vulnerabilities under active attack, added both CVEs to its Known Exploited Vulnerabilities catalog. That list only includes bugs confirmed to be in use against real targets. WordPress.org went further than a normal release notice and force-pushed the fix through auto-update, because waiting for site owners to update manually wasn't fast enough. If a site was sitting on 6.8 through 7.0.1 through mid-to-late July, that wasn't a maintenance item to get to eventually. That was a door left open while people were actively trying the handle.

Is wp2shell the only thing to worry about from July 2026?

No. Core got the headline, but the week of July 17 to 24 alone saw 93 separate vulnerabilities disclosed across WordPress core, plugins, and themes, including issues in Yoast SEO and BuddyPress. Neither is an obscure plugin nobody's heard of. Most sites run a dozen or more plugins, so the odds that at least one shipped a patch that's still sitting there uninstalled aren't small.

What's this mu-plugins backdoor about?

Separately from wp2shell, researchers flagged a backdoor campaign hiding inside the /wp-content/mu-plugins/ folder this month. Must-use plugins load automatically in the background and don't appear on the normal Plugins screen in wp-admin, which makes that folder a genuinely good place to hide something. A site could be compromised right now with the owner having no reason to ever look there, because there's never been a reason to.

What should you check on your site right now?

None of this means WordPress is a broken platform. It means WordPress runs a large enough share of the internet that attackers treat finding new holes in it like a job, and a site nobody's watching stays exposed by default, not by accident. That's also where continuous monitoring earns its keep, catching a version that's fallen behind or a plugin update that shipped something unexpected, without anyone having to remember to go looking.

Frequently Asked Questions

How do I know if my WordPress site is patched against wp2shell?

Check your version in wp-admin under Dashboard > Updates, or Tools > Site Health > Info. You're safe from this specific chain on 6.8.6, 6.9.5, 7.0.2, or later. Anything on 6.8 through 7.0.1 needs updating now, not on your next maintenance pass.

Does a security plugin like Wordfence protect me from wp2shell?

It reduces risk but isn't a substitute for the core patch. A web application firewall can block some exploit attempts, but the vulnerability lives in WordPress core itself, so updating to a fixed version is the actual fix, not an optional extra layer.

What if auto-updates are turned off on my site?

Then WordPress.org's forced push for this specific bug may not have reached you, and the update is sitting there waiting on you to click it manually. Log in and check your version today rather than assuming the emergency patch already applied itself.

How do I check the mu-plugins folder for a backdoor?

Connect via FTP or your host's file manager and open /wp-content/mu-plugins/. Anything in there loads automatically and won't appear on your normal Plugins screen, so look for files you don't recognize or didn't put there yourself. If anything looks unfamiliar, don't delete it yourself first, ask your host or developer to look at it.

My site wasn't affected. Is there still a lesson here?

Yes. Most site owners find out about a problem from a customer, a search-engine warning, or a host suspension notice, not from checking their own dashboard. A site being watched continuously catches this kind of thing on its own, instead of depending on someone remembering to look.