A WordPress site takeover bug is spreading right now

A chained WordPress core vulnerability nicknamed wp2shell lets an unauthenticated visitor take over a stock WordPress install, and it has been under mass automated attack since mid-July.

wp2shell is the nickname researchers gave to two WordPress core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, that chain together into a pre-authentication remote code execution path. Searchlight Cyber found the pair, WordPress shipped fixes in versions 6.8.6, 6.9.5, and 7.0.2 on July 17, 2026, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog four days later, on July 21, after confirming active attacks.

What wp2shell actually does

The first flaw is a route confusion bug in the REST API's batch endpoint that lets an attacker reach code paths meant to require a login. The second is a SQL injection that turns that access into control over the database. Chained together, the two give an anonymous visitor a path to drop a web shell on a stock WordPress install with no vulnerable plugin or theme involved. That is what separates this from most WordPress incidents, where the plugin folder is usually the weak point. This time the bug lived in core, in versions before 6.8.6, 6.9.5, and 7.0.2.

How to know if you're exposed

1. 1

   Check your version

   Log into wp-admin and read the version number at the bottom of the dashboard. Anything older than 6.8.6, 6.9.5, or 7.0.2 is exposed.

2. 2

   Confirm the patch actually landed

   If background auto-updates are on, WordPress.org pushed this fix on July 17. Confirm it applied instead of assuming it did, especially on sites with auto-updates disabled by a caching or security plugin.

3. 3

   Scan for a web shell

   Look in wp-content/uploads and the plugin and theme folders for PHP files that do not belong there, especially anything added since mid-July. Hosting providers are already publishing compromise and recovery write-ups for customers who got hit, which tells you how fast this moved.

4. 4

   Review who has admin and author access

   Any admin account created or any role elevated since mid-July that you do not recognize is a reason to reset every password on the site.

The WordPress site takeover playbook

1. Update to 6.8.6, 6.9.5, or 7.0.2 today, not this weekend.
2. If you cannot update immediately, block /wp-json/batch/v1 and ?rest_route=/batch/v1 at your firewall or CDN.
3. Have your host or a WordPress security service scan for web shells and unfamiliar admin accounts.
4. Rotate your WordPress secret keys and salts, and force a password reset for every account with publish or admin access.
5. If you find a web shell, treat the whole site as compromised and restore from a clean backup rather than just deleting the file.

Patching closes today's hole, but the account list behind your WordPress site is worth a second look on your own schedule. Fewer people with author or admin access, auto-updates turned on, and a real answer for who checks the dashboard when a core release like this one lands on a Friday. If you want a second set of eyes on how your site and the automations tied to it are locked down, bring me your setup and we'll go through it.