On 17 July, WordPress released version 7.0.2 to patch a vulnerability chain security researchers have named “wp2shell”, one of the most serious WordPress core flaws in years. Four days later, on 21 July, we updated every website we manage, roughly 350 sites, to close it off.
Most of our clients never noticed this happened. And that’s our goal, to resolve the problem before it causes any impact to your business.
What made wp2shell different
Most WordPress security scares come from a vulnerable plugin, something a site owner installed and forgot about. wp2shell was different because it was in WordPress core itself, meaning every affected site was exposed regardless of what plugins were installed, or whether any were installed at all.
It’s actually two separate bugs, tracked as CVE-2026-63030 and CVE-2026-60137, that only became dangerous when chained together. The first is a flaw in how WordPress’s REST API handles batch requests, which allowed an anonymous visitor to slip past the normal authentication checks entirely. On its own, that’s a problem. Chained with the second bug, a SQL injection flaw in how WordPress queries its database, an attacker could use that unauthenticated access to inject database commands, create their own administrator account, and ultimately run code on the server. No login, no plugin, no user interaction required.
The affected versions were WordPress 7.0.0 to 7.0.1 (fixed in 7.0.2), 6.9.0 to 6.9.4 (fixed in 6.9.5), and, for the SQL injection component alone, 6.8.0 to 6.8.5 (fixed in 6.8.6).
Why the urgency
WordPress considered the risk serious enough to force automatic updates onto many sites, and security researchers reported real-world attacks beginning within a day or two of the fix going public. Public proof-of-concept code is already circulating, which tends to accelerate mass scanning: automated tools that crawl the web looking for any site still running a vulnerable version. With a bug this severe living in core rather than a plugin, that pool of exposed sites has been estimated in the tens of millions worldwide.
Our team ensured all our managed websites we’re updated on the 21st of July 2026.
Why we’re changing how often we update
This wasn’t a one-off effort. Attacks like this are becoming more common as automated tools make it easier for hackers to scan the web for vulnerable sites the moment a flaw becomes public. In response, we’ve decided to move to a more regular update schedule across all the sites we manage, rather than waiting for the next headline-grabbing patch.
If your website was built or is managed by us, this update is already done. If you’re managing your own WordPress site, here’s what’s worth doing today:
- Check your version. In your WordPress admin area, go to Dashboard > Updates and confirm you’re running 7.0.2, 6.9.5, or 6.8.6, whichever applies to your site.
- Update if you haven’t already. Click “Update Now”, or ask your developer to run it for you if you’re not comfortable doing it yourself.
- Look for anything unusual. Because proof-of-concept exploits are public, it’s worth checking your list of administrator users for anyone you don’t recognise, and checking whether any core files have been modified.
It takes a few minutes and it’s one of the cheapest forms of insurance your business can have.
The takeaway
Website security isn’t a set-and-forget task, it’s an ongoing responsibility. If yesterday’s news made you wonder whether your site is protected, that’s a good instinct to have. Reach out and we’ll take a look.
