wp2shell: WordPress Bug Letting Hackers Take Over Your Site Remotely

WordPress, one of the biggest platforms, is solely responsible for roughly 42-43% of all the websites running on the internet that were developed using this platform, it is very user-friendly, that’s why most of the people use this platform to develop their websites and it is mostly used for the blogging sites such as news sites and magazines and you may be aware NASA’s official site is running on WordPress and a famous tech magazine, TechCrunch, is running on WordPress.

Coming to the point that I wanted to share, WordPress has patched two critical bugs last week that will allow attackers to take control of our site remotely and one of the bugs was named wp2shell (CVE-2026-63030) and the other was a SQL injection bug (CVE-2026-60137) that gets chained with it to make the attack even worse. The bug was found by Adam Kues from Searchlight Cyber (Assetnote) and disclosed to WordPress on July 17, 2026. the affected WordPress versions were 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, if you recently updated your WordPress, that means there is nothing to worry but if you didn’t update, go and update it to version 7.0.2 or 6.9.5 (if you’re on 6.8.x, update to 6.8.6 for the SQL injection issue) and also, if you are using any security plugins such as Wordfence or if you have integrated your site with Cloudflare, that reduces your risk while you update, but it’s not a replacement for actually updating — you still need to patch your site.

But if you didn’t, then take the necessary action to safeguard your site as soon as possible, especially since security firms are now reporting that this bug is being actively exploited in the wild as of July 18-20, and also there is a site which will tell you whether your site is affected or not. I will mention the link below. You can visit the site and check whether your site is affected or not.

Link