If you’ve seen the term “WP2Shell” floating around a security newsletter or a client forum this week, here’s the short version: it’s a serious WordPress vulnerability, it affected a portion of the sites we manage, and it’s already fixed. No action is required on your end if we host your site.
Here’s what actually happened, in plain terms first, then the technical details for anyone who wants them.
What Happened, In Plain English
WordPress.org released a security update on July 17, 2026, patching two vulnerabilities in WordPress core – the software every WordPress site runs on, regardless of theme or plugins. Combined, these two issues could let an attacker run their own code on an unprotected site without ever logging in. Security researchers gave the pair the nickname “WP2Shell,” which is where you may have seen that name.
We audited every WordPress installation across our managed hosting infrastructure, identified which sites were running an affected version, and patched every one of them. That work was completed on July 18, 2026. If your site is hosted with us, it’s already handled.
The Technical Details
For anyone who wants the specifics, this vulnerability is actually two separate CVEs that become significantly more dangerous when combined:
CVE-2026-60137 – A SQL injection vulnerability in the author__not_in parameter of WP_Query, the class WordPress uses to build nearly every database query on a site. It carries a CVSS score of 9.1 (Critical) and affects WordPress 6.8 and later. On its own, this is a data-integrity risk – an attacker could manipulate what a query returns.
CVE-2026-63030 – A route confusion issue (CWE-436) in the REST API’s batch endpoint (/wp-json/batch/v1), rated 7.5 (High). This flaw has technically existed in WordPress core since version 5.6 in 2020, but only becomes exploitable for remote code execution when chained with the SQL injection above, on WordPress 6.9 and later. No login or user interaction is required to exploit it.
In short: the SQL injection is the opening, and the REST API issue is what turns it into full server-side code execution on sites running 6.9 or newer. Sites on 6.8.x are exposed to the SQL injection but not the code-execution chain, since the REST API flaw wasn’t yet dangerous at that version.
Affected versions and fixes:
| Version range | Risk | Fixed in |
|---|---|---|
| 6.8.x before 6.8.6 | SQL injection only | 6.8.6 |
| 6.9.x before 6.9.5 | SQL injection + remote code execution | 6.9.5 |
| 7.0.x before 7.0.2 | SQL injection + remote code execution | 7.0.2 |
| 7.1 Beta before Beta 2 | SQL injection + remote code execution | 7.1 Beta 2 |
What We Did
WordPress.org published the fix on July 17, 2026. We ran a full audit across our hosting infrastructure the same day, checking the installed WordPress version on every managed site against the vulnerable ranges above. Any site running an affected version got patched to the corresponding fixed version – and only that version, not the newest release available. We verified the update on every site by confirming the new version number and checking that the site still loaded correctly, then cleared server-side caching to make sure the update actually took effect.
By July 18, 2026, every managed site we identified as vulnerable was patched and verified.
What This Means For You
If you host with us, there’s nothing you need to do. Your site has already been checked and, if it needed patching, patched.
If you manage your own WordPress hosting elsewhere, check your version under Dashboard > Updates in wp-admin, and compare it against the table above. If you’re running an affected version, update to the fixed release for your branch as soon as possible.
Frequently Asked Questions
Do I need to worry about this update breaking something on my site?
No. This was a security-only patch, not a feature release. WordPress core updates within the same version branch (like 6.9.4 to 6.9.5) don’t change how the software works – they only fix the specific issue being patched. We didn’t touch plugins, themes, or site content.
If my site was on WordPress 6.x, did you upgrade it to 7.x?
No, and we wouldn’t unless you asked us to separately. We patched each site to the fixed version within its existing branch – a 6.9.4 site went to 6.9.5, not to 7.0.2. Jumping multiple major versions at once carries a real risk of breaking plugin or theme compatibility, and that’s not a risk worth taking during an emergency security patch. Major version upgrades are a separate, planned conversation, not something we bundle into a same-day security fix.
Was my site actually compromised before you patched it?
We found no evidence of compromise on any of the sites we reviewed. Patching closes the door going forward, but if you’d like a closer look at your specific site’s logs, reach out and we can take one.
Why didn’t you patch this before it became public knowledge?
Because that’s not how responsible disclosure works. Security researchers report vulnerabilities like this privately to the WordPress security team, who fix the issue and release the patch at the same moment the vulnerability becomes public knowledge. There’s no earlier window where a fix exists but isn’t public – the patch and the disclosure happen together, by design, specifically so that attackers don’t get a head start. Once that happens, speed is what matters, and we had it patched across our infrastructure within a day.
Do I need to change my WordPress password or take any other security steps?
Not because of this specific issue – it doesn’t involve credentials. If you’re generally due for a password refresh, that’s always good practice, but it’s not required as a result of this patch.
A Note on Staying Ahead of This
WordPress core issues like this are rare, but they happen. Keeping WordPress core, themes, and plugins current is the single biggest thing that protects a site from this kind of vulnerability – and it’s the reason we monitor for these releases and act on them as part of managing your hosting, rather than waiting for you to notice.
If you have questions about your site’s security or want to talk through your hosting setup, reach out to our team – we’re happy to walk through it.
