The WordPress Exploit July 2026, widely known as WP2Shell, has quickly become one of the most significant cybersecurity events affecting the WordPress ecosystem in recent years. Unlike the majority of WordPress attacks that target vulnerable plugins or themes, WP2Shell affects WordPress Core itself, putting millions of websites at potential risk.
The attack combines two vulnerabilities—CVE-2026-63030 and CVE-2026-60137—into a single exploit chain capable of achieving unauthenticated Remote Code Execution (RCE). In simple terms, a successful attack could allow a malicious actor to execute code on a vulnerable server without needing to log in first.
Security researchers reported widespread Internet scanning shortly after the vulnerabilities were disclosed, highlighting how quickly attackers move to exploit newly discovered security flaws. In response, the WordPress Security Team released emergency security updates and enabled automatic security updates for supported installations, helping protect millions of websites worldwide.
If you manage a WordPress website, understanding WP2Shell and applying the appropriate security measures should be considered a top priority.
What is WP2Shell?
WP2Shell is the name given to an exploit chain that combines two separate WordPress Core vulnerabilities:
- CVE-2026-63030 – A critical REST API vulnerability with a CVSS score of 9.8 (Critical).
- CVE-2026-60137 – A SQL Injection vulnerability with a CVSS score of 5.9 (Medium).
On their own, both vulnerabilities present security risks. However, modern cyberattacks rarely rely on a single weakness. Instead, attackers often chain multiple vulnerabilities together, allowing one flaw to open the door for another. WP2Shell is an example of this technique.
The REST API vulnerability allows specially crafted requests to reach functionality that should normally be inaccessible. Combined with the SQL Injection vulnerability, attackers may be able to execute arbitrary code on the server, potentially gaining complete control over the affected website.
Why This Exploit Is Different
WordPress security advisories commonly involve third-party plugins or themes, where only websites using a specific extension are affected. WP2Shell is different because it impacts WordPress Core itself, making the potential attack surface much larger.
Security researchers have also described WP2Shell as the first critical unauthenticated Remote Code Execution vulnerability affecting WordPress Core in nearly a decade. Unlike many previous vulnerabilities, attackers do not need administrator credentials or a compromised user account to begin the attack.
Another important factor is the speed at which attackers responded. Shortly after public disclosure, security companies reported automated Internet-wide scanning for vulnerable websites. This demonstrates how quickly newly disclosed vulnerabilities can become active targets and reinforces the importance of installing security updates as soon as they become available.
Who Is Affected?
The affected versions include:
- WordPress 6.8.0 – 6.8.5
- WordPress 6.9.0 – 6.9.4
- WordPress 7.0.0 – 7.0.1
WordPress has released security updates in:
How to Protect Your Website
The most effective way to protect your website is to update WordPress immediately to a patched version. Installing the official security update removes the vulnerable code and closes the attack path used by WP2Shell.
If updating immediately is not possible—for example, due to compatibility testing or business requirements—you should implement temporary security measures to reduce your exposure until the update can be installed.
Recommended security practices include:
- Restrict public access to the WordPress REST API where possible.
- Keep trusted security plugins active and up to date.
- Remove unused themes and plugins.
- Ensure automatic WordPress security updates are enabled.
- Maintain regular backups that can be restored if your website becomes compromised.
Don’t Stop After Updating
Installing the latest WordPress version closes the vulnerability, but it does not automatically remove malware or unauthorized changes if attackers successfully exploited your website before it was patched.
If a compromise occurred, attackers may have created administrator accounts, uploaded malicious PHP files, installed web shells, modified plugins or themes, or established other methods of maintaining access to the website. Simply updating WordPress will not remove these changes.
After applying the security update, website administrators should perform a basic security review by:
- Checking for unknown administrator accounts.
- Reviewing recently modified files.
- Looking for suspicious PHP files, particularly inside upload directories.
- Running a malware scan using a trusted security solution.
- Changing administrator passwords if compromise is suspected.
- Restoring from a clean backup if malicious modifications are discovered.
Final Thoughts
WP2Shell demonstrates how two separate vulnerabilities—CVE-2026-63030 and CVE-2026-60137—can be combined into a powerful exploit capable of compromising vulnerable WordPress websites without authentication. Its impact has attracted widespread attention because it affects WordPress Core itself rather than relying on third-party plugins, making it one of the most significant WordPress security disclosures in recent years.
Fortunately, the WordPress Security Team responded quickly by releasing patched versions and enabling automatic security updates for supported installations. If your website has not yet been updated, treat this as an urgent priority.
More importantly, remember that cybersecurity is an ongoing process rather than a one-time task. Applying updates promptly, monitoring your website for suspicious activity, maintaining secure backups, and regularly reviewing administrator accounts are all essential practices for keeping your WordPress website secure against future threats.