On July 17, the WordPress project shipped an emergency update, and by July 21 the flaw it fixed was on the United States' catalogue of vulnerabilities being actively used in attacks. What makes this one, nicknamed wp2shell, worth your attention is what it does not need: no vulnerable plugin, no add-on, no misconfiguration. A plain, default WordPress site running the affected version can be taken over by an anonymous attacker on the internet. If your business website runs on WordPress, this is a patch-now item.
What wp2shell is
wp2shell is the nickname for a pair of flaws in WordPress core itself (tracked as CVE-2026-63030 and CVE-2026-60137) that chain together. Researchers at Rapid7 described how one flaw confuses WordPress's request handling and the other is a classic database-injection bug; used in sequence, an unauthenticated visitor can trick the site into creating a new administrator account, and from there upload a malicious plugin and run code on the server. In short, a stranger goes from "no access" to "full control of your website" without ever logging in. Multiple public exploit tools appeared within hours of the fix, and CISA added the flaws to its Known Exploited Vulnerabilities catalogue on July 21, which is the strongest available signal that attackers are using this right now.
Why this one is different
We have written before about how WordPress plugins are usually the weak point, because most WordPress break-ins come through an out-of-date or abandoned add-on. wp2shell flips that lesson. This hole is in WordPress itself, so "I keep my plugins tidy" does not save you. The only thing that matters here is whether WordPress core is up to date. That is a useful reminder that the platform, not just its extensions, needs patching, and that on the web, the gap between a fix being published and being exploited is now measured in hours.
What to do now
- Update WordPress core immediately. The fixed versions are 6.9.5 and 7.0.2. If you are on 6.9.0 to 6.9.4 or 7.0.0 to 7.0.1, update today. Most managed hosts pushed this automatically, but confirm rather than assume.
- Check that auto-updates are on. WordPress can apply minor and security releases by itself. For most small business sites this should be enabled, so the next emergency fix lands without you being awake for it.
- Assume you may have been probed, and look. Because exploitation started fast, check for unexpected administrator accounts, unfamiliar plugins, or changed files. If anything looks off, treat it as a possible compromise and follow your incident response plan.
- Make sure you have a clean backup. An off-site backup from before the patch date is your undo button if the site was tampered with.