WordPress core wp2shell flaws exploited: confirm you run 7.0.2, 6.9.5 or 6.8.6

On July 17, 2026, the WordPress Security Team released WordPress 7.0.2, 6.9.5 and 6.8.6 to fix two flaws in WordPress itself, now known as "wp2shell" (CVE-2026-60137 and CVE-2026-63030). Chained together, they let an attacker who has no account create an administrator and run code on the server. No vulnerable plugin or theme is needed: a default WordPress site exposed to the internet is enough.

Wordfence saw the first exploit attempts against the vulnerable endpoint the same evening, and public attack code appeared in the following days. On July 21, 2026, CISA, the US cybersecurity agency, added both flaws to its list of vulnerabilities known to be exploited, as the Canadian Centre for Cyber Security also reported.

WordPress.org turned on forced automatic updates for affected sites. If your site has updated since then, you are most likely already protected, but check the version.

Who is affected

• WordPress 6.9 and 7.0 before 6.9.5 and 7.0.2: exposed to the full takeover chain.
• WordPress 6.8 before 6.8.6: exposed to the database flaw only, and should still be updated.
• Versions before 6.8 are not affected, according to WordPress.org.

How to check your site

1. Log in to your WordPress dashboard and open Dashboard > Updates. The page shows the version you run.
2. Compare it with the fixed versions: 7.0.2, 6.9.5 or 6.8.6 (or any later version).
3. Open Users and look for administrator accounts you do not recognise.
4. Open Plugins and look for plugins you did not install yourself.

If you do not have access to the dashboard, ask your host or developer which WordPress version the site runs.

What to do now

1. If your version is older than the fixed ones, click Update Now on the Updates page, or ask your host or developer to do it today.
2. Check that the update actually completed. Automatic updates can fail silently.
3. If you find an unknown administrator or plugin, treat the site as compromised: ask your host or a security professional to clean it, then change all passwords.
4. Keep automatic updates for WordPress core turned on.

This alert reports what the sources listed below published and is not a guarantee about any specific site.