wp2shell: what it is and how to protect your WordPress

In short

On 17 July 2026 WordPress shipped an emergency release for a pair of flaws nicknamed wp2shell (CVE-2026-63030 and CVE-2026-60137). They are serious for two reasons. First, they are exploitable pre-authentication: no login, no stolen password, no unlucky plugin required, just a site reachable from the internet running an out-of-date version. Second, the exploit code is already public and automated attacks began within days. If your WordPress is among the affected versions, the only thing that matters is updating today.

Which versions are affected

The full attack chain, the one that leads to code execution on the server, affects WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1. Versions 6.8.0 to 6.8.5 share only half the problem: the flaw that lets data be pulled from the database, without the feature the full attack goes through. The fixes shipped the same day: 6.8.6, 6.9.5 and 7.0.2. Anyone on one of these, or on a later already-released version, is safe from this flaw.

Watch for one tricky case: WordPress 7.1 hasn't shipped its final release yet (due August 2026), and its first beta predates the fix by two days. If your site declares «7.1» without the exact build, check it by hand. Don't assume «newer» means «fixed».

How to know if you're vulnerable

The most direct check is done by whoever manages the site: in the WordPress dashboard, under Dashboard → At a Glance, you can read the installed version. If it's below 6.9.5 (or 7.0.2), update immediately. If you don't have dashboard access or want a quick check from outside, our free wp2shell checker reads the version the site publicly declares and compares it with the fixed ones. It sends no attack attempt: that would risk damaging the site and, on a site that isn't yours, would be an offence.

What to do, in order

1. Update WordPress to 6.9.5, 7.0.2 or 6.8.6, from the dashboard under Updates. It takes minutes.
2. If an agency manages the site, forward them this check today: it's not maintenance that can wait for the next round.
3. If you were exposed for days, review administrator accounts, change admin passwords, and have recently modified files and the logs checked for unusual requests to /wp-json/batch/v1.
4. If you can't update right away, blocking anonymous access to the batch REST endpoints at your WAF or web server is a stopgap, a temporary measure, not a substitute for updating.

Want to start with the check? Run the wp2shell check on your site: thirty seconds, free, no data collected.