What Is the wp2shell Vulnerability?
wp2shell is the combined name for two vulnerabilities tracked as CVE-2026-63030 and CVE-2026-60137, both affecting WordPress core rather than any specific plugin or theme.
How the exploit actually works
Security researcher analysis published by BleepingComputer and in a detailed technical breakdown from The Hacker News breaks the chain into two parts. CVE-2026-63030 is a route confusion bug in the WordPress REST API's batch-processing endpoint, it lets an attacker invoke internal handlers without passing any permission check, which bypasses authentication entirely. CVE-2026-60137 is a SQL injection issue stemming from improper sanitisation of a parameter inside WP_Query when untrusted data reaches it. Chained together, the two bugs let an anonymous attacker achieve remote code execution using a single HTTP request, no login, no plugin, no theme required.
Who is affected
Every WordPress site running version 6.9 or 7.0 before the forced patch was in range. Cloudflare's analysis notes one meaningful caveat: CVE-2026-63030 enables unauthenticated remote code execution specifically when persistent object caching isn't in use, a detail worth checking with your host if you manage your own server. According to Searchlight Cyber, the security firm that disclosed the issue, the vulnerability chain was found using AI-assisted vulnerability research in just over 10 hours, a detail that matters beyond this one bug: it signals that AI tools are now lowering the bar for finding this class of vulnerability, which likely means we see more of these, faster, going forward.
How to Check If Your Site Is Vulnerable or Already Hacked
Confirm your WordPress version
Log into your WordPress admin dashboard and check Dashboard to Updates, or look at the footer of your admin panel. If you're running anything below 6.9.5 or 7.0.2, you are still exposed and need to update immediately, ideally through a staging environment first if you have custom code that might conflict.
Signs your site may already be compromised
If your site has been running an unpatched version since before July 17, check for these common signs of compromise:
- Unexpected redirects sending visitors to unrelated sites
- New admin user accounts you didn't create
- Unfamiliar files inside your wp-content or wp-includes directories
- A sudden drop in Google Search rankings (often caused by injected SEO spam)
- Your hosting provider flagging your site for malicious activity
If any of these apply, treat your site as compromised, not just vulnerable, and move straight to cleanup rather than just patching.
What patching alone does not fix
This is the detail most guides skip. Updating to 6.9.5 or 7.0.2 closes the door the attacker used, it does not remove anything the attacker already left behind. If your site was compromised before you patched, the patch closes the entry point while the backdoor, the fake admin account, or the injected code stays exactly where it was.
What to Do If Your WordPress Site Has Already Been Hacked
Reacting in the right order matters here. Based on how we handle malware cleanup for clients, this is the sequence we follow:
- 1Take the site offline or put it in maintenance mode to stop the compromise from spreading or continuing to serve malicious content to visitors.
- 2Change every password, WordPress admin accounts, hosting control panel, database, and FTP/SFTP, since a compromised site may have exposed all of them.
- 3Update WordPress core, every plugin, and every theme to the latest patched versions.
- 4Scan for and remove unauthorised admin accounts. Go to Users in your dashboard and remove anything you don't recognise.
- 5Search for injected code and backdoors in theme files, plugin files, and the wp-config.php file, specifically anything with base64_decode, eval(, or unfamiliar PHP functions.
- 6Restore from a clean backup if one exists from before the compromise, then reapply any legitimate content changes made since.
- 7Request a Google Search Console review if your site was flagged for malware or your rankings dropped, once you've confirmed the site is clean.
If any of that feels beyond what your team can confidently handle alone, that's a reasonable place to bring in outside help rather than guessing, a partially cleaned hack is often worse than an untouched one, since it can hide remaining backdoors behind a false sense of security.
Why WordPress Keeps Having Moments Like This
WordPress powers a huge share of the web, and that scale is exactly why it's targeted constantly. This year alone has been unusually active: SolidWP tracked 333 new vulnerabilities in a single week of January 2026 across plugins and themes, a supply-chain attack compromised the popular Gravity Forms plugin by infecting manual installers on the vendor's own site, and in April 2026 more than 30 plugins were pulled from the official repository after a backdoor was traced to a change in ownership at Essential Plugin, as covered in TechCrunch's reporting on the Essential Plugin backdoor.
The pattern across all of these, wp2shell included, is that attackers are getting faster and more sophisticated at finding these flaws, partly because AI-assisted research tools are now doing in hours what used to take security researchers weeks. That's not a reason to panic, but it is a reason to treat WordPress security as an ongoing discipline rather than a one-time setup task.
The Reality of Handling This In-House
Most small businesses running WordPress don't have anyone whose job is to track CVE disclosures, apply emergency patches within hours, and know how to tell the difference between "vulnerable" and "already compromised." That's not a criticism, it's just not what most in-house teams were hired to do, and it's a genuinely different skill set from building or maintaining the site's day-to-day content.
The honest challenge is that vulnerabilities like this move fast. wp2shell went from disclosure to active mass exploitation in roughly a week. A site owner checking email once a day can miss the entire window between "patch available" and "actively being hacked."
Where We Fit
If you're comfortable applying WordPress core updates yourself and you're confident you'd recognise the signs of a compromise, you likely don't need us for this specific issue, just make sure you're on 6.9.5 or 7.0.2 today if you haven't checked already. Where we come in is for site owners who want ongoing monitoring so this kind of thing gets caught and fixed before it becomes a five-alarm problem, or who need a hacked site cleaned properly rather than just patched on the surface.
That's the same process behind our WordPress security and malware removal work, $30 an hour, written scope before any billing starts.
Working on a WordPress security and malware cleanup project?
Written scope before billing. $30/hr. We tell you if we're not the right fit.
Akash Singh
·View full profileCTO and Co-Founder, CV Infotech · Gurugram, India
Akash has been building software for clients in the USA, UK, Australia, and Canada since 2012. He leads a 100% in-house team and personally manages every client relationship and technical decision. Francisco Escobar has worked with him since 2012. Steven has trusted the team with his AI platforms since 2019. 512 verified 5.0 reviews on Freelancer.com.