A combination of two vulnerabilities was found in the WordPress core, allowing you to take over a website without a password and without a single plugin installed. The patch was released back in July, but thousands of sites still have not been updated — and hackers are actively taking advantage of this.
What happened
On July 17, 2026, the WordPress team released emergency updates 6.9.5, 7.0.2 and 6.8.6, closing a critical set of vulnerabilities that cybersecurity experts called WP2Shell. The problem was discovered by Searchlight Cyber - remarkably, using the GPT 5.6 Sol language model. The patch was released quietly, without unnecessary noise, but after a few days the situation changed dramatically: the companies Patchstack, Hexastrike and WatchTowr began to record real attacks on sites that had not yet been updated. According to Defiant, the first scan related to WP2Shell occurred literally on the day the patch was released — and just 13 minutes later, researchers noticed an attempt at exploitation.
What does the attack consist of
WP2Shell is not one vulnerability, but a chain of two. The first, CVE-2026-63030, appeared in the code with the release of WordPress 6.9 and is related to the processing of the REST API batch endpoint: due to an error, the engine could confuse nested request handlers. The second, CVE-2026-60137, is a classic SQL injection in the WP_Query class parameter, which dates back to version 6.8.
Individually, these bugs are less dangerous, notes xrust, but together they give an unauthorized attacker the opportunity to remotely execute arbitrary code on the server — and on the most common, “clean” installation of WordPress, without any vulnerable plugins. After the vulnerabilities became publicly known, ready-made PoC exploits quickly appeared on the network, followed by specialized frameworks for mass attacks: Wiz Research researchers noted in the logs characteristic user strings like wp2shell or rezwp2shell, indicating the use of such tools.
Which versions are at risk
class=»notranslate»>__GTAG5__ A full-fledged remote code execution attack works on WordPress versions 6.9.0–6.9.4 and 7.0.0–7.0.1. On older builds, from 6.8.0 to 6.8.5, only the SQL injection vulnerability is present — it is less critical, but it also allows an attacker to gain unauthorized access to the site's database.
The attacks are already leading to the deployment of web shells on compromised servers and the creation of new administrator accounts — according to researchers, the script chain creates an account with the characteristic w2s_ prefix with each attempt, successful or not. However, experts warn: this prefix is simply an artifact of the default settings in a public PoC, and an experienced attacker can easily change it, so you should not rely on such a “signature” when searching for traces of hacking.
What should site owners do
class=»notranslate»>__GTAG5__ The main and only reliable protection is updating. If the site is running on WordPress 6.9.x or 7.0.x, you should immediately check the engine version in the admin panel and update to 6.9.5 or 7.0.2 accordingly; For the older branch 6.8.x, version 6.8.6 is current. Additionally, it is recommended:
— check the list of site administrators for unfamiliar accounts;
— view server logs for abnormal activity around the date the vulnerability was discovered (July 17) and later;
— if possible, connect a WAF (application level firewall) — it is able to block typical exploitation patterns even before the request reaches the site engine;
— make a backup copy of the database and site files after the update in order to have a rollback point if signs of compromise are detected.
Why is this important
WordPress still remains the most common CMS on the Internet — it powers a significant share of all sites on the network, including many Russian projects, from blogs to online stores. That is why vulnerabilities in the engine core, and not in third-party plugins, pose a particular danger: even minimalistic, “clean” installations are at risk, the owners of which often do not pay attention to the protection of them, mistakenly believing that since there are few plugins, there is nothing to risk. The story with WP2Shell once again shows: in the case of mass CMSs, the delay in updating security is measured not in days, but in minutes before the first attack attempt.
Sources:
- https://xakep.ru/2026/07/21/wp2shell/
- https://habr.com/ru/companies/kaspersky/articles/1060812/
https://1275.ru/ioc/kriticheskaya-tsepochka-uyazvimostey-wp2shell-aktivno-ekspluatiruetsya-v-atakah-na-wordpress_32510
Xrust WordPress is under attack: critical WP2Shell vulnerability is already exploited
- Если Вам понравилась статья, рекомендуем почитать
- Hackers infected hundreds of npm packages with ransomware
- Korean photonic chip has learned to slow down light. This could change the architecture of AI servers
