Is your WordPress vulnerable to wp2shell?
In July 2026 a flaw emerged that lets an attacker take control of a WordPress site without knowing its password. It is already being exploited by automated attacks. Find out in seconds whether your version is among those affected.
Genuinely free. No sign-up, no email, no limits, no cookies. We don't store the URL you analyse.
Loading the security check…
What happened, in two minutes
On 17 July 2026 WordPress shipped an emergency release for a pair of flaws nicknamed wp2shell. The severity comes down to one word: pre-authentication. Exploiting them requires no account on the site, no stolen password, and no unlucky plugin. It only takes a site reachable from the internet running an out-of-date version. Whoever succeeds gains the ability to execute code on the server, and from there anything follows, from invisible spam pages to stealing your contact database.
The second word that matters is public. Exploit code has already circulated openly and attacks started within days of disclosure. These aren't attackers picking their victims: they are automated programs sweeping millions of addresses looking for old versions. A small site is no less interesting than a big one: if anything it's easier prey, because it's less likely to be patched quickly.
What this tool checks (and what it doesn't do)
We look for the WordPress version number where your site normally publishes it: the generator tag on the home page, the RSS feed, the public REST index, and the readme file if it was left accessible. We then compare that number against the list of affected versions. We also check whether the endpoint the attack travels through is reachable from outside, as an extra clue when the version isn't readable.
What we do not do is try to attack your site to see whether it gives way. That would be the only way to get a hundred-percent certain answer, and it's exactly why tools that do it should only be pointed at sites you own, carefully: an exploit attempt can leave traces, pollute the database or take the site down. Here anyone can type any address, so the choice makes itself, and we state it plainly: passive analysis, and a verdict that is honest about its own limits.
What to do if the result is red
Update, today. This is not maintenance to fold into the next scheduled visit: every day that passes leaves the site exposed to automated scanning. From the WordPress dashboard go to Updates and press «Update Now»; the target is 6.9.5 or 7.0.2 (6.8.6 if the site is still on the 6.8 branch). If an agency or a developer looks after the site, copy the report with the button above and send it over: it contains the detected version and the fixed version, which is everything needed to agree on what to do in one line.
If the site sat exposed for days, one more step is worth taking after updating. Italy's CERT-AGID advises looking for signs of compromise rather than assuming the update settled it: unusual requests to /wp-json/batch/v1 and ?rest_route=/batch/v1 in the server logs, newly created administrator accounts, unexpected changes to site files, unknown plugins or themes, PHP files that don't belong to the installation, odd database activity, and changes to configuration or credentials. If anything looks suspicious, updating alone may not be enough: isolate the system, preserve the evidence, and treat every password, token and key reachable from the site as compromised.
If you genuinely cannot update right now, blocking anonymous access to the batch REST endpoints at the web server or WAF is a stopgap, but it can break legitimate functionality and it is not a substitute for installing the fixed version.
Frequently asked questions
›What is wp2shell, in plain English?
It's a flaw in the heart of WordPress, disclosed in July 2026, that lets a stranger run commands on your site without a password and without an account. In practice whoever exploits it owns the site: they can inject spam pages, steal customer data, redirect visitors or wipe everything. Technically it's two chained defects, CVE-2026-63030 and CVE-2026-60137. No particular plugin is needed to be affected: an out-of-date WordPress is enough.
›Which WordPress versions are affected?
The full remote-code-execution chain affects WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1. Versions 6.8.0 to 6.8.5 are affected by the SQL injection half (CVE-2026-60137) but not by the complete chain. The fixes shipped on 17 July 2026 in 6.8.6, 6.9.5 and 7.0.2.
›My site updates itself. Am I safe?
Probably, but it's worth confirming rather than assuming. WordPress pushed a forced update to sites with automatic updates enabled, yet those are often switched off years earlier by an agency, a security plugin or a hosting configuration, without the site owner knowing. This check tells you which version your site declares today.
›Does this tool attack my site to test it?
No, never, and it wouldn't even on your own site. We only read public pages that your site shows to anyone: the home page, the RSS feed, the REST index, the readme file. We compare the declared version number against the fixed ones and send no exploit attempt whatsoever. That's a deliberate choice: a test that genuinely attacks a site risks damaging it, and against a site whose ownership we cannot verify it would simply be an attack.
›The result is green. Can I relax?
It means the version your site declares already contains the fix, which is the thing that matters most. Two honest caveats, though. First, we read the declared version, and a compromised or misconfigured site can declare something other than what's really installed. Second, and more serious: if the site sat exposed in the days after 17 July 2026, updating closes the door but doesn't evict anyone already inside. If you suspect you were hit, review administrator accounts and recently modified files.
›It says you can't read the version. Is that bad?
No. Hiding the version number is good security practice, it just leaves us blind too. In that case check by hand: whoever manages the site opens the WordPress dashboard and reads the installed version under Dashboard, At a Glance. If it's below 6.9.5 (or 7.0.2), update immediately.
›I don't use WordPress. Does this affect me?
No. wp2shell is a defect in WordPress's own code, so a site built on another system or hand-built isn't touched by this particular flaw. The tool says so explicitly when it finds no trace of WordPress.